CVE-2025-30153: Improper Handling of Highly Compressed Data (Data Amplification) in github.com/getkin/kin-openapi/openapi3filter
Vulnerability summary
CVE-2025-30153 is a high (CVSS 7.5) vulnerability in getkin kin-openapi. EPSS estimates a 0.62% chance of exploitation in the next 30 days, higher than 49.8% of scored vulnerabilities.
Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 1% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 4 · Related 26Timeline
- 19-03-2025PublishedVulnerability first disclosed.
- 19-03-2025Last modifiedVulnerability information updated.
Description
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.131.0, when validating a request with a multipart/form-data schema, if the OpenAPI schema allows it, an attacker can upload a crafted ZIP file (e.g., a ZIP bomb), causing the server to consume all available system memory. The root cause comes from the ZipFileBodyDecoder, which is registered automatically by the module (contrary to what the documentation says). This vulnerability is fixed in 0.131.0.
CVSS metrics
7 scores · 7 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · GoEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.62%
Chance of exploitation in the next 30 days
Percentile
50%
Versus all other CVEs
30-day change
Increase +0.09 pp
From 0.53% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard32 products
- dataplaneapi< 3.1.5-r2
- dataplaneapi-fips< 3.1.5-r2
- gitnessAll versions (No fix recorded)
- gptscript< 0.9.5-r11
- grafana-11.3All versions (No fix recorded)
Wolfi10 products
- dataplaneapi< 3.1.5-r2
- gitnessAll versions (No fix recorded)
- gptscript< 0.9.5-r11
- kubevelaAll versions (No fix recorded)
- kubevela-vela-cliAll versions (No fix recorded)
Debian1 product
- golang-github-getkin-kin-openapiAll versions (No fix recorded) | < 0.135.0-1
Getkin1 product
- kin-openapi< 0.131.0
Github.com/getkin1 product
- kin-openapi< 0.131.0
Opensuse1 product
- grafana&distro=openSUSE Tumbleweed< 11.6.14+security01-4.1
Ubuntu1 product
- golang-github-getkin-kin-openapiAll versions (No fix recorded)
7 vendors · 47 products
References
13 links- github.com/getkin/kin-openapi/security/advisories/GHSA-wq9g-9vfc-cfq9X Refsource CONFIRMREPORTAdvisoryWEB
