EUVD-2026-82602
GHSA-j354-7hcm-wg69
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify service parsing OpenAPI/ordered JSON
-
DeliveryCraft deeply nested JSON payload
-
ExploitSubmit to unauthenticated endpoint
-
ExecutionTrigger unbounded recursion in ordered marshal/unmarshal
-
PersistFatal stack overflow crashes process
-
ImpactAll in-flight requests dropped (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Recursion depth limits
|
| Exploitation Conditions | Exploitable against any Go service that uses go-openapi/swag jsonutils (before 0.27.1) to parse or serialize ordered JSON from untrusted input - specifically endpoints accepting OpenAPI specification documents or otherwise routing attacker-controlled JSON through the ordered marshal/unmarshal path. No authentication, no user interaction, and no non-default configuration are required (PR:N/UI:N), since the vulnerable code had no depth limit at all prior to the fix. The practical LIMIT is exposure: the flaw only bites where an externally reachable endpoint feeds attacker-supplied JSON into this library; internal-only or spec-validated-elsewhere deployments are not reachable. Impact is confined to process availability (crash of the service and loss of in-flight requests); no data exposure or modification occurs. |
| Impact | This is a genuine but bounded denial-of-service issue, not a code-execution threat. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H, base 8.7) is internally consistent with the description: remote, unauthenticated, low-complexity, availability-only impact (VC:N/VI:N/VA:H). CWE-674 (uncontrolled recursion) is the correct root cause; the description's phrase 'stack overflow' means recursion-driven stack exhaustion, not a memory-corruption buffer overflow, so the RCE/corruption path that a high 8.7 might imply does NOT exist here - confidentiality and integrity are untouched. There is no EPSS score, no CISA KEV listing, and no public exploit code referenced, so exploitation status is 'no public exploit identified at time of analysis.' However, the patch commit and the added depth_test.go provide a precise, trivially reproducible recipe (a JSON document of N nested objects/arrays), so weaponization effort is near-zero even without a published PoC. Net: real priority for any Go service that parses attacker-supplied OpenAPI/ordered-JSON with go-openapi/swag, but the ceiling is process crash / request termination, not compromise. Treat as a patch-promptly availability bug rather than an emergency. |
| Exploit ScenarioDerived | An attacker sends a single deeply nested JSON document (e.g. thousands of nested objects or arrays) to an HTTP endpoint of a Go service that parses or serializes it via go-openapi/swag jsonutils ordered marshal/unmarshal. The unbounded recursion exhausts the goroutine stack, triggering a fatal Go runtime stack overflow that kills the entire process and drops all in-flight requests. No authentication or user interaction is needed; the patch's depth_test.go effectively documents the crafting recipe though no standalone PoC is published. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 18, 2026
Stack exhaustion in go-openapi/swag's jsonutils package before 0.27.1 allows unauthenticated remote attackers to crash any Go service that parses or serializes ordered JSON from untrusted input - most notably endpoints that accept OpenAPI specification documents or otherwise route attacker-controlled JSON through the ordered marshal/unmarshal path - by submitting a deeply nested document that recurses without any depth limit. The result is a fatal Go stack overflow that terminates the process and drops all in-flight requests; there is no data exposure or modification, so impact is confined to availability (CVSS 8.7, CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VA:H). No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, but exploitation requires only a single crafted request, so exposure should be treated as high for internet-facing services built on this library. The underlying defect is CWE-674 (uncontrolled recursion).
RemediationAI
Vendor-released patch: upgrade go-openapi/swag to 0.27.1 or later, which introduces the ErrMaxNestingDepth sentinel, a default nesting budget, and the WithMaxNestingDepth adapter option so over-deep documents return an error instead of exhausting the goroutine stack. The fix is delivered by upstream commit 0c24346ced59a25811e8694a915e7131d25ccb0e and documented in GHSA-xh24-9qpg-8w28; after upgrading, run go mod tidy and confirm no indirect dependency pins an older swag version, since the vulnerable code may be pulled in transitively by go-openapi/go-swagger tooling. Where upgrading cannot happen immediately, construct adapters with an explicit WithMaxNestingDepth value once on a patched build, or for unpatched builds enforce a compensating control in front of the service: reject JSON bodies whose maximum nesting depth exceeds a sane bound (OpenAPI documents rarely exceed a few dozen levels) and cap request body size at the reverse proxy or API gateway - noting that API-gateway depth/size filtering adds latency and may reject legitimately large or deeply nested specifications, so thresholds must be tuned against real spec corpora. Additionally, do not expose spec-parsing endpoints to unauthenticated clients if they do not need to be public, and, where practical, run the parsing service as a separate process or replica so a fatal stack overflow does not take down unrelated traffic; note that this is containment only, since the crash still kills all in-flight requests on the affected instance. No public exploit code was identified at time of analysis, but the trigger is trivial to construct and patching should be prioritized for any externally reachable service using the library.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
go-openapi/swag is a support library used across the go-openapi ecosystem (and by downstream tooling such as go-swagger) to handle OpenAPI documents, including an "ordered JSON" representation (MapSlice) that preserves key ordering for spec round-tripping. The vulnerability is CWE-674, uncontrolled recursion: both the stdlib-backed adapter (jsonutils/adapters/stdlib/json/adapter.go and ordered_map.go) and the easyjson-backed adapter implemented OrderedMarshal / OrderedUnmarshalJSON as straight recursive descent over nested objects and arrays with no depth budget. Because Go grows goroutine stacks dynamically and a stack overflow is a fatal, unrecoverable runtime error (panic/recover cannot catch runtime: goroutine stack exceeds limit), a single adversarially nested document - e.g. repeated {"a": ... } objects or nested arrays - drives the parser past the runtime stack limit and kills the whole process rather than returning an error. The upstream fix (commit 0c24346) introduces an ErrMaxNestingDepth error, a default depth budget, and a WithMaxNestingDepth adapter option, routing nested ordered values through a depth-decremented path so that over-deep input returns an error instead of crashing. The vulnerability class is therefore a design gap in recursive JSON deserialization rather than a memory-safety bug, despite the 'Buffer Overflow' tag applied by the reporting feed.
Know when Go gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Remote unauthenticated deeply-nested JSON crashes the process with no interaction (AV:N/AC:L/PR:N/UI:N); availability-only impact (A:H), no confidentiality or integrity effect.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
2DescriptionCVE.org
go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON parsing and serialization due to unbounded recursion with no depth limit. Remote unauthenticated attackers can submit deeply nested JSON documents to services accepting OpenAPI specifications, causing fatal stack overflow that terminates the process and all in-flight requests.
Technical POC Analysis
Advisory GHSA-xh24-9qpg-8w28 itself lists "No known CVE"; the CVE-2026-93450 mapping and CVSS 8.7 come from the record above, not the advisory text.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
A high-severity availability flaw in the go-openapi/swag library's jsonutils package can let an unauthenticated remote attacker terminate any Go service that processes attacker-supplied JSON through the ordered marshal/unmarshal path, which includes common endpoints that accept OpenAPI specification documents. There is no data exposure or modification, but a single crafted request crashes the process and drops all in-flight work, so internet-facing and internal API services built on this library can be taken offline repeatedly with minimal attacker effort. Leadership should care because no vendor-released patch is identified at time of analysis, meaning near-term risk must be absorbed through edge controls and dependency governance until a fix is confirmed and deployed.
No vendor-released patch identified at time of analysis; interim mitigations include strict request body size limits and JSON nesting-depth rejection at the WAF/reverse proxy, pre-parse JSON schema validation, rate limiting, disabling or authenticating OpenAPI specification upload and validation endpoints, removing the affected ordered marshal/unmarshal path from untrusted-input handling where possible, and running affected services with process supervision, health checks, alerts on crash loops, and horizontal redundancy to limit outage duration.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and there
Critical certificate validation bypass in Go crypto/tls during session resumption. If ClientCAs or RootCAs fields are mu
net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization by
Casdoor through 4.4.0 exposes its instance-wide built-in JWT signing private key unmasked through the /api/get-certs and
Host header injection in Nezha 2.2.3's OAuth2 redirect endpoint (/api/v1/oauth2/{provider}) allows an unauthenticated re
Session cross-wiring in SUSE NeuVector before 5.6.1 allows an unauthenticated remote attacker to obtain another user's a
Unauthenticated path traversal in Uber Kraken through 0.1.29 allows remote attackers to read files outside the configure
The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import pa
Denial of service in Temporal Server allows an authenticated caller holding at least namespace read permission to crash
Account takeover in Klever-Go's KleverUpdateAccountPermission built-in (all versions prior to 1.7.20) allows an attacker
Maliciously crafted on-chain account names processed by Klever-Go prior to 1.7.20 are spliced into Elasticsearch _bulk r
Exploit-DB