CVE-2025-30153 in kin-openapi
Summary
by MITRE • 03/19/2025
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.131.0, when validating a request with a multipart/form-data schema, if the OpenAPI schema allows it, an attacker can upload a crafted ZIP file (e.g., a ZIP bomb), causing the server to consume all available system memory. The root cause comes from the ZipFileBodyDecoder, which is registered automatically by the module (contrary to what the documentation says). This vulnerability is fixed in 0.131.0.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/21/2025
The vulnerability identified as CVE-2025-30153 affects the kin-openapi Go library, a widely used project for handling OpenAPI specifications in applications that process API requests. This security flaw specifically manifests during the validation of multipart/form-data requests where the OpenAPI schema permits such uploads. The issue stems from the automatic registration of the ZipFileBodyDecoder component, which contradicts the library's documented behavior and creates an unexpected attack vector for malicious actors. The vulnerability exists in versions prior to 0.131.0, making all earlier releases susceptible to exploitation through crafted ZIP file uploads.
The technical root cause of this vulnerability lies in the ZipFileBodyDecoder's automatic registration within the kin-openapi module, which processes multipart/form-data requests without proper safeguards against malicious file content. When an attacker uploads a specially crafted ZIP file that functions as a ZIP bomb, the decoder attempts to decompress and process the archive contents, leading to excessive memory consumption that can exhaust available system resources. This behavior represents a classic denial of service attack vector where computational resources are consumed at an unsustainable rate, ultimately causing system instability or complete resource exhaustion. The vulnerability aligns with CWE-400, which catalogs weaknesses related to resource exhaustion, and specifically demonstrates how improper input handling can lead to memory consumption issues.
The operational impact of this vulnerability extends beyond simple denial of service scenarios, as it can severely compromise system stability and availability. Attackers can exploit this flaw by uploading malicious ZIP files that, when processed by the automatic decoder, cause memory allocation to spiral out of control. This creates a scenario where legitimate system operations become impossible due to resource exhaustion, potentially affecting multiple services or applications that rely on the affected OpenAPI processing capabilities. The automatic registration aspect makes this vulnerability particularly dangerous because it operates without explicit developer configuration, meaning that any application using the affected library version becomes vulnerable regardless of explicit security considerations during implementation.
Organizations and developers using kin-openapi versions prior to 0.131.0 should immediately implement mitigation strategies to address this vulnerability. The primary and most effective solution involves upgrading to version 0.131.0 or later, which includes the necessary fixes to prevent automatic registration of the potentially dangerous ZipFileBodyDecoder. Additionally, implementing input validation measures such as file size limits, content type checks, and explicit schema restrictions can provide additional layers of protection. Security teams should also consider implementing monitoring for unusual memory consumption patterns and establish automated alerting for resource exhaustion events. From an ATT&CK framework perspective, this vulnerability maps to techniques involving resource exhaustion and privilege escalation, and organizations should consider the implications for their defensive strategies and incident response procedures. The fix in version 0.131.0 demonstrates the importance of proper component registration and the need for comprehensive testing of automatic behavior in security-sensitive libraries.