CVE-2026-93450
highgo-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON parsing and serialization due to unbounded recursion with no de…
go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON parsing and serialization due to unbounded recursion with no depth limit. Remote unauthenticated attackers can submit deeply nested JSON documents to services accepting OpenAPI specifications, causing fatal stack overflow that terminates the process and all in-flight requests.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/go-openapi/swag disclosure@vulncheck.com
- https://github.com/go-openapi/swag/blob/v0.27.0/jsonutils/adapters/stdlib/json/adapter.go#... disclosure@vulncheck.com
- https://github.com/go-openapi/swag/blob/v0.27.0/jsonutils/adapters/stdlib/json/ordered_map... disclosure@vulncheck.com
- https://github.com/go-openapi/swag/commit/0c24346ced59a25811e8694a915e7131d25ccb0e disclosure@vulncheck.com
- https://github.com/go-openapi/swag/security/advisories/GHSA-xh24-9qpg-8w28 disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/go-openapi-swag-jsonutils-before-0.27.1-uncontrolled-... disclosure@vulncheck.com
- https://github.com/go-openapi/swag/security/advisories/GHSA-xh24-9qpg-8w28 134c704f-9b21-4f2e-91b3-4a467353bcc0