Description
go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON parsing and serialization due to unbounded recursion with no depth limit. Remote unauthenticated attackers can submit deeply nested JSON documents to services accepting OpenAPI specifications, causing fatal stack overflow that terminates the process and all in-flight requests.
References7
- github.com/go-openapi/swag
- github.com/go-openapi/swag/blob/v0.27.0/jsonutils/adapters/stdl…
- github.com/go-openapi/swag/blob/v0.27.0/jsonutils/adapters/stdl…
- github.com/go-openapi/swag/commit/0c24346ced59a25811e8694a915e7…
- github.com/go-openapi/swag/security/advisories/GHSA-xh24-9qpg-8…
- www.vulncheck.com/advisories/go-openapi-swag-jsonutils-before-0…
- github.com/go-openapi/swag/security/advisories/GHSA-xh24-9qpg-8…
Metrics
- CVSS 3.1
-
7.5
HIGH
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 4.0
-
8.7
HIGH
Score source: CNA
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - EPSS — exploit probability
- 1% percentile: 71 · as of 8 November 2026
- CWE
- CWE-674
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.