Vulnerability in Go-Openapi Swag
CVE-2026-93450
go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON parsing and serialization due to unbounded recursion with no depth limit. Remote unauthenticated attackers can submit deeply nested JSON documents to services accepting OpenAPI specifications, causing fatal stack overflow that terminates the process and all in-flight requests.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.009 (60.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 60th percentile — 60.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.009 · newest: 0.009 · change: 0.000
Affected products
Weakness classification (CWE)
References
- github.com/go-openapi/swag/security/advisories/GHSA-xh24-9qpg-8w28 (vendor-advisory)
- github.com/go-openapi/swag/commit/0c24346ced59a25811e8694a915e7131d25ccb0e (patch)
- github.com/go-openapi/swag/blob/v0.27.0/jsonutils/adapters/stdlib/json/adapter… (technical-description)
- github.com/go-openapi/swag/blob/v0.27.0/jsonutils/adapters/stdlib/json/ordered_… (technical-description)
- github.com/go-openapi/swag (product)
- www.vulncheck.com/advisories/go-openapi-swag-jsonutils-before-0.27.1-uncontroll… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-93450?
- CVE-2026-93450 is a high-severity vulnerability in Go-Openapi Swag, classified under Uncontrolled Recursion. CVSS score: 7.5/10. Published 2026-09-18.
- How severe is CVE-2026-93450?
- High severity. CVSS v3 base score is 7.5 out of 10.