Vulnerability · Published Sep 17, 2026 · Assigned by VulnCheck
CVE-2026-93450go-openapi/swag jsonutils before 0.27.1 Uncontrolled Recursion in Ordered JSON Marshal and Unmarshal
High 7.5
In plain English
A high-severity security flaw in swag from go-openapi. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.3%top 29.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON parsing and serialization due to unbounded recursion with no depth limit. Remote unauthenticated attackers can submit deeply nested JSON documents to services accepting OpenAPI specifications, causing fatal stack overflow that terminates the process and all in-flight requests.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| go-openapi | swag | 0 – before 0.27.1 |
Weakness: CWE-674 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- GitHub Security Advisory (GHSA-xh24-9qpg-8w28) vendor-advisory
- https://github.com/go-openapi/swag/commit/0c24346ced59a25811e8694a915e7131d25ccb0e patch
- https://github.com/go-openapi/swag/blob/v0.27.0/jsonutils/adapters/stdlib/json/adapter.go#L68 technical-description
- https://github.com/go-openapi/swag/blob/v0.27.0/jsonutils/adapters/stdlib/json/ordered_map.go#L214 technical-description
- https://github.com/go-openapi/swag product
- VulnCheck Advisory: go-openapi/swag jsonutils before 0.27.1 Uncontrolled Recursion in Ordered JSON Marshal and Unmarshal third-party-advisory