CVE-2026-93450 in swag
Summary
by MITRE • 09/18/2026
go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON parsing and serialization due to unbounded recursion with no depth limit. Remote unauthenticated attackers can submit deeply nested JSON documents to services accepting OpenAPI specifications, causing fatal stack overflow that terminates the process and all in-flight requests.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/18/2026
The go-openapi/swag library, specifically prior to version 0.27.1, contains a critical stack overflow vulnerability within its jsonutils package during the parsing and serialization of ordered JSON documents. This flaw stems from unbounded recursion that lacks any mechanism for depth limiting or validation of nesting levels. When processing deeply nested JSON structures, the recursive functions responsible for traversing and converting data types exceed the available call stack space allocated by the Go runtime environment. Because this vulnerability is triggered during standard parsing operations, it does not require complex exploitation techniques but rather relies on the volume and structure of input data to exhaust system resources.
Remote unauthenticated attackers can exploit this weakness by submitting maliciously crafted JSON documents with extreme levels of nesting to services that utilize go-openapi/swag for OpenAPI specification handling or API request processing. The impact is immediate and severe, resulting in a fatal stack overflow error that causes the affected process to terminate abruptly. This termination leads to a denial of service condition, as all in-flight requests handled by the compromised instance are dropped without completion. For services relying on this library for high-throughput API gateways or microservices, such an event can cause significant downtime and disrupt business continuity until the application is restarted and recovered from the crash state.
From a classification perspective, this vulnerability aligns with CWE-675, which describes operations with duplicate or excessive steps, specifically manifesting here as uncontrolled recursion depth. It also relates to CWE-400, concerning Uncontrolled Resource Consumption, where an attacker can cause the system to consume more resources than intended through recursive processing loops. In terms of offensive security frameworks, this attack vector corresponds to MITRE ATT&CK technique T1499, Endpoint Denial of Service, as it involves overwhelming a specific component or service with resource-intensive input to degrade availability rather than compromising confidentiality or integrity directly.
Mitigation strategies primarily involve upgrading the go-openapi/swag library to version 0.27.1 or later, where developers have implemented safeguards such as maximum recursion depth limits and iterative parsing alternatives for deeply nested structures. Organizations should also implement strict input validation at the network perimeter using Web Application Firewalls that detect unusually deep JSON nesting patterns before they reach the application layer. Additionally, configuring runtime environment variables to increase stack size may provide temporary relief but is not a secure long-term solution since it merely delays rather than prevents the overflow condition. Regular dependency audits and automated vulnerability scanning should be integrated into the software development lifecycle to identify such library vulnerabilities early in the deployment pipeline.