Vulnerability in Getkin Kin-Openapi
CVE-2025-30153
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.131.0, when validating a request with a multipart/form-data schema, if the OpenAPI schema allows it, an attacker can upload a crafted ZIP file (e.g., a ZIP bomb), causing the server to consume all available system memory. The root cause comes from the ZipFileBodyDecoder, which is registered automatically by the module (contrary to what the documentation says). This vulnerability is fixed in 0.131.0.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.005 (42.3th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 42nd percentile — 42.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: +0.000
Affected products
- Getkin Kin-Openapi — versions < 0.131.0
Weakness classification (CWE)
References
- github.com/getkin/kin-openapi/security/advisories/GHSA-wq9g-9vfc-cfq9
- github.com/getkin/kin-openapi/commit/67f0b233ffc01332f7d993f79490fbea5f4455f1
- github.com/getkin/kin-openapi/blob/6da871e0e170b7637eb568c265c08bc2b5d6e7a3/ope…
- github.com/getkin/kin-openapi/blob/6da871e0e170b7637eb568c265c08bc2b5d6e7a3/ope…
- github.com/getkin/kin-openapi
Frequently asked questions
- What is CVE-2025-30153?
- CVE-2025-30153 is a high-severity vulnerability in Getkin Kin-Openapi, classified under Improper Handling of Highly Compressed Data (Data Amplification). CVSS score: 7.5/10. Published 2025-03-19.
- How severe is CVE-2025-30153?
- High severity. CVSS v3 base score is 7.5 out of 10.