CVE-2026-93450

Overview

The go-openapi/swag jsonutils library (v0.27.0 and earlier) has a stack‑overflow flaw when parsing deeply nested JSON. Attackers can send malformed OpenAPI specs to any service that uses this library, causing the process to crash and all current requests to fail.

Description

go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON parsing and serialization due to unbounded recursion with no depth limit. Remote unauthenticated attackers can submit deeply nested JSON documents to services accepting OpenAPI specifications, causing fatal stack overflow that terminates the process and all in-flight requests.

Impact

The vulnerability leads to a denial‑of‑service condition by terminating the target process. Availability is the primary CIA impact; confidentiality and integrity are not directly affected. Services that rely on the vulnerable library will become unavailable until patched or mitigated, potentially disrupting downstream services and user access.

Remediation

['Upgrade go-openapi/swag to version 0.27.1 or later, which adds a recursion depth limit.', 'If an upgrade is not immediately possible, implement input validation to reject JSON objects exceeding a safe nesting depth before they reach the library.', 'Deploy the application in a container or sandbox with limited stack size to contain the crash.', 'Monitor application logs for stack‑overflow errors and trigger automated restarts or alerts.', 'Apply any vendor‑issued hotfixes or patches for related components that may also use the same parsing logic.']

Risk context

With a CVSS v3 score of 7.5 and v4 score of 8.7, this is a high‑severity denial‑of‑service flaw. Although no EPSS data is available, the lack of authentication and the potential for widespread impact warrant prompt remediation.

Affected products

• go-openapi/swag
• go-openapi
• OpenAPI services
• API gateways
• Microservice frameworks
• Swagger UI
• OpenAPI generators
• Go-based web servers