Vulnerability Description
go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON parsing and serialization due to unbounded recursion with no depth limit. Remote unauthenticated attackers can submit deeply nested JSON documents to services accepting OpenAPI specifications, causing fatal stack overflow that terminates the process and all in-flight requests.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/go-openapi/swag
- https://github.com/go-openapi/swag/blob/v0.27.0/jsonutils/adapters/stdlib/json/a
- https://github.com/go-openapi/swag/blob/v0.27.0/jsonutils/adapters/stdlib/json/o
- https://github.com/go-openapi/swag/commit/0c24346ced59a25811e8694a915e7131d25ccb
- https://github.com/go-openapi/swag/security/advisories/GHSA-xh24-9qpg-8w28
- https://www.vulncheck.com/advisories/go-openapi-swag-jsonutils-before-0.27.1-unc
- https://github.com/go-openapi/swag/security/advisories/GHSA-xh24-9qpg-8w28
FAQ
What is CVE-2026-93450?
CVE-2026-93450 is a vulnerability with a CVSS score of 7.5 (HIGH). go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON parsing and serialization due to unbounded recursion with no depth limit. Remote unauthenticated attacke...
How severe is CVE-2026-93450?
CVE-2026-93450 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-93450?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.