TI-2024-36951 Aliases CVE-2024-55885 GHSA-9j3m-fr7q-jxfw

Beego Vulnerable to Collision Hazards of MD5 in Cache Key Filenames

LOW 36CWE-327Published 2024-12-12 · Updated 2024-12-13

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Information disclosure
Confidentiality · integrity · availability: None · Low · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-327.

Summary

beego is an open-source web framework for the Go programming language. Versions of beego prior to 2.3.4 use MD5 as a hashing algorithm. MD5 is no longer considered secure against well-funded opponents due to its vulnerability to collision attacks. Version 2.3.4 replaces MD5 with SHA256.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00347 28th percentileScored 2026-11-07

Fix Fixed beego (beego): 2.3.4github.com/beego/beego/v2 (Go): 2.3.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
beego	beego	before 2.3.4	2.3.4	Patch available	CNA
—	github.com/beego/beego (Go)	up to 1.12.14	—	No fix listed	GHSA-9j3m-fr7q-jxfw
—	github.com/beego/beego/v2 (Go)	before 2.3.4	2.3.4	Patch available	GHSA-9j3m-fr7q-jxfw

beego Vendorbeego Affected before 2.3.4 Fixed in 2.3.4 Patch available CNA
github.com/beego/beego (Go) Vendor— Affected up to 1.12.14 Fixed in — No fix listed GHSA-9j3m-fr7q-jxfw
github.com/beego/beego/v2 (Go) Vendor— Affected before 2.3.4 Fixed in 2.3.4 Patch available GHSA-9j3m-fr7q-jxfw

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:beego:beego::::::::	before 2.3.4	Vulnerable	beego

cpe:2.3:a:beego:beego:*:*:*:*:*:*:*:* Versions before 2.3.4 Vulnerable ·beego

Remediation

Fix · CNA beego (beego) Fixed in 2.3.4
Fix · GHSA-9j3m-fr7q-jxfw github.com/beego/beego/v2 (Go) Fixed in 2.3.4 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2024-55885
2026-10-03 Alias added: GHSA-9j3m-fr7q-jxfw

References

Patch 1

https://github.com/beego/beego/commit/e7fa4835f71f47ab1d13afd638cebf661800d5a4

Advisory 2

Other 1

https://github.com/beego/beego

TI-2025-21559 Beego allows Reflected/Stored XSS in Beego's RenderForm() Function Due to Unescaped User Input CVSS 3.1CRITICAL 9.6
TI-2022-13292 The route lookup process in beego before 1.12.9 and 2.x before 2.0.3 allows attackers to… CVSS 3.1CRITICAL 9.8
TI-2022-13707 The leafInfo.match() function in Beego v2.0.3 and below uses path.join() to deal with… CVSS 3.1CRITICAL 9.8
TI-2021-10653 An issue was discovered in the route lookup process in beego before 1.12.11 that allows… CVSS 3.1CRITICAL 9.8
TI-2024-26936 An issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via… CVSS 3.1HIGH 8.8
TI-2024-26937 An issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via… CVSS 3.1HIGH 8.8

See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences