CVE-2026-93450: go-openapi swag Uncontrolled Recursion
Vulnerability summary
CVE-2026-93450 is a high (CVSS 8.7) Uncontrolled Recursion vulnerability in go-openapi swag. EPSS estimates a 0.92% chance of exploitation in the next 30 days, higher than 59.5% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 16Timeline
- 17-09-2026PublishedVulnerability first disclosed.
- 18-09-2026Last modifiedVulnerability information updated.
Description
go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON parsing and serialization due to unbounded recursion with no depth limit. Remote unauthenticated attackers can submit deeply nested JSON documents to services accepting OpenAPI specifications, causing fatal stack overflow that terminates the process and all in-flight requests.
CVSS metrics
5 scores · 3 sources · 2 versions- NVDNIST8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · Red hatEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.92%
Chance of exploitation in the next 30 days
Percentile
60%
Versus all other CVEs
30-day change
+0.25 pp
From 0.66% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Go-openapi1 product
- swag< 0.27.1
Redhat1 product
- cosign< 0:3.1.3-0.2.hum1
2 vendors · 2 products
References
14 links- github.com/go-openapi/swag/blob/v0.27.0/jsonutils/adapters/stdlib/json/adapter.goTechnical DescriptionARTICLE
- github.com/go-openapi/swag/blob/v0.27.0/jsonutils/adapters/stdlib/json/ordered_map.goTechnical DescriptionARTICLE
Show all 14 references
- images.redhat.comARTICLE