PT-2026-95187 · Github · Swag
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
go-openapi/swag jsonutils versions prior to 0.27.1
Description
A stack overflow issue exists in ordered JSON parsing and serialization caused by unbounded recursion without a depth limit. Remote unauthenticated attackers can exploit this by submitting deeply nested JSON documents to services that accept OpenAPI specifications. This results in a fatal stack overflow that terminates the process and drops all in-flight requests.
Recommendations
Update to version 0.27.1.
Exploit
Fix
DoS
Uncontrolled Recursion
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Swag