CVE-2026-93450

Katalog CVE

CVSS 7.5 · High EPSS 0,92%

Kerentanan Uncontrolled Recursion. Skor CVSS 3.1 7.5 (High) menurut vulncheck.com.

Deskripsi (NVD)

go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON parsing and serialization due to unbounded recursion with no depth limit. Remote unauthenticated attackers can submit deeply nested JSON documents to services accepting OpenAPI specifications, causing fatal stack overflow that terminates the process and all in-flight requests.

Rincian

Terbit di NVD

18 September 2026

Terakhir diubah

22 September 2026

Status NVD

Awaiting Analysis

CVSS 3.1

7.5 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-674: Uncontrolled Recursion

EPSS (30 hari)

0,92% peluang dieksploitasi; lebih tinggi dari 59,1% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/go-openapi/swag
• https://github.com/go-openapi/swag/blob/v0.27.0/jsonutils/adapters/stdlib/json/adapter.go#L68
• https://github.com/go-openapi/swag/blob/v0.27.0/jsonutils/adapters/stdlib/json/ordered_map.go#L214
• https://github.com/go-openapi/swag/commit/0c24346ced59a25811e8694a915e7131d25ccb0e
• https://github.com/go-openapi/swag/security/advisories/GHSA-xh24-9qpg-8w28
• https://www.vulncheck.com/advisories/go-openapi-swag-jsonutils-before-0.27.1-uncontrolled-recursion-in-ordered...