CVE-2026-93450 – Denial of Service (Stack Overflow) – go-openapi/swag jsonutils < 0.27.1

Summary

CVE-2026-93450 is an uncontrolled recursion (CWE-674) vulnerability in the jsonutils module of go-openapi/swag, a widely used Go library that underpins OpenAPI/Swagger tooling and is pulled in transitively by many API frameworks and code generators. Versions prior to 0.27.1 lack any recursion depth limit when parsing or serializing "ordered" JSON structures, allowing a remote, unauthenticated attacker to crash any service that processes attacker-supplied JSON or OpenAPI/Swagger documents through the affected functions. The issue is rated HIGH severity (CVSS 8.7).

Technical details

• Root cause: go-openapi/swag‘s custom JSON lexer/parser used for ordered JSON (JSONMapSlice) recurses once per nesting level with no maximum-depth check, unlike Go’s standard encoding/json package, which has enforced nesting limits since Go 1.15.
• Trigger conditions: Submitting a deeply nested JSON document (a proof-of-concept of roughly 6 MB with excessive nesting has been demonstrated) to any code path that calls the vulnerable functions: jsonutils.ReadJSON, JSONMapSlice.UnmarshalJSON (unmarshaling), jsonutils.WriteJSON, JSONMapSlice.MarshalJSON (marshaling), and transitively loading.YAMLDoc/loading.JSONDoc.
• Attack vector: Network — no authentication or user interaction required. Any HTTP endpoint, API gateway, or tool that ingests untrusted JSON or OpenAPI/Swagger specifications via go-openapi/swag is reachable.
• Impact: The Go runtime raises a fatal error: stack overflow, which cannot be recovered from within the process — it terminates the entire application, not just the handling goroutine, resulting in a full denial of service for the affected service.

Affected software

• github.com/go-openapi/swag (module path github.com/go-openapi/swag/jsonutils) — all versions before 0.27.1
• Any downstream project that vendors or depends on the vulnerable swag jsonutils code path (e.g., OpenAPI/Swagger spec loaders, kube-openapi, and other consumers of go-openapi/swag) inherits the exposure until they update their dependency

Severity

• CVSS Score: 8.7 (HIGH)
• CVSS v4.0 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
• (A CVSS v3.1 rating of 7.5, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, has also been published for this issue)

Mitigation and recommended actions

• Immediate: Upgrade go-openapi/swag to version 0.27.1 or later, which introduces recursion depth limiting for ordered JSON parsing/serialization. Also update any dependency (such as kube-openapi or other OpenAPI tooling) that vendors the vulnerable jsonutils code so the fixed version is actually pulled in.
• If immediate patching is not possible:
  • Place a request-size limit and a WAF/reverse-proxy rule in front of any endpoint that accepts JSON or OpenAPI/Swagger documents to reject unusually large or deeply nested payloads before they reach the application.
  • Run services that parse untrusted OpenAPI specs or JSON with constrained goroutine/process isolation (e.g., separate worker processes) so a stack-overflow crash does not take down the entire application.
  • Audit dependency trees for indirect use of go-openapi/swag‘s jsonutils package and prioritize upgrading any transitive dependency that exposes attacker-controlled JSON to it.

References

• CVE-2026-93450 at NIST NVD
• GitHub Security Advisory GHSA-xh24-9qpg-8w28 (go-openapi/swag)
• Fix commit 0c24346 (go-openapi/swag)