{
  "cve_id": "CVE-2026-30246",
  "vulnerable_version": "v3.1.0",
  "fixed_version": "v3.2.0",
  "verdict": "confirmed",
  "summary": "In Fiber v3 <= 3.1.0, the default cache middleware KeyGenerator returns only c.Path(), ignoring query strings. This causes cache key collisions for requests to the same path with different query parameters. Reproduction shows that requesting /?id=1 then /?id=2 both return '1' under the vulnerable version, while the fixed version returns '1' and '2' respectively.",
  "vulnerable_results": {
    "request_1_id": "1",
    "request_1_response": "1",
    "request_2_id": "2",
    "request_2_response": "1",
    "indicator": "cache_collision"
  },
  "fixed_results": {
    "request_1_id": "1",
    "request_1_response": "1",
    "request_2_id": "2",
    "request_2_response": "2",
    "indicator": "cache_distinguishes_requests"
  },
  "reproduction_script": "repro/reproduction_steps.sh",
  "rca_report": "repro/rca_report.md",
  "timestamp": "2026-05-23T06:14:19Z"
}