{"id":"CVE-2026-93450","title":"go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON parsing and serialization due to unbounded recursion with no depth limit","summary":"go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON parsing and serialization due to unbounded recursion with no depth limit. Remote unauthenticated attackers can submit deeply nested JSON docu…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-674","CWE-770"],"vendor":"go-openapi","product":"swag","affected":["swag < 0.27.1"],"published":"2026-09-18","updated":"2026-09-22","sourceUpdated":"2026-09-22T20:25:55.870","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-93450","references":[{"url":"https://github.com/go-openapi/swag","label":"disclosure@vulncheck.com"},{"url":"https://github.com/go-openapi/swag/blob/v0.27.0/jsonutils/adapters/stdlib/json/adapter.go#L68","label":"disclosure@vulncheck.com"},{"url":"https://github.com/go-openapi/swag/blob/v0.27.0/jsonutils/adapters/stdlib/json/ordered_map.go#L214","label":"disclosure@vulncheck.com"},{"url":"https://github.com/go-openapi/swag/commit/0c24346ced59a25811e8694a915e7131d25ccb0e","label":"disclosure@vulncheck.com"},{"url":"https://github.com/go-openapi/swag/security/advisories/GHSA-xh24-9qpg-8w28","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/go-openapi-swag-jsonutils-before-0.27.1-uncontrolled-recursion-in-ordered-json-marshal-and-unmarshal","label":"disclosure@vulncheck.com"},{"url":"https://github.com/go-openapi/swag/security/advisories/GHSA-xh24-9qpg-8w28","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93450.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-93450"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2538979"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-93450"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93450"},{"url":"https://access.redhat.com/errata/RHSA-2026:72488"},{"url":"https://access.redhat.com/errata/RHSA-2026:72497"},{"url":"https://access.redhat.com/errata/RHSA-2026:74871"},{"url":"https://access.redhat.com/errata/RHSA-2026:72498"},{"url":"https://access.redhat.com/errata/RHSA-2026:71906"},{"url":"https://access.redhat.com/errata/RHSA-2026:72507"},{"url":"https://access.redhat.com/errata/RHSA-2026:85266"},{"url":"https://access.redhat.com/errata/RHSA-2026:68717"},{"url":"https://access.redhat.com/errata/RHSA-2026:68729"},{"url":"https://access.redhat.com/errata/RHSA-2026:72570"},{"url":"https://access.redhat.com/errata/RHSA-2026:72496"},{"url":"https://access.redhat.com/errata/RHSA-2026:68272"},{"url":"https://access.redhat.com/errata/RHSA-2026:68290"},{"url":"https://access.redhat.com/errata/RHSA-2026:68591"},{"url":"https://access.redhat.com/errata/RHSA-2026:72750"},{"url":"https://access.redhat.com/errata/RHSA-2026:72489"},{"url":"https://access.redhat.com/errata/RHSA-2026:72493"},{"url":"https://access.redhat.com/errata/RHSA-2026:72490"},{"url":"https://access.redhat.com/errata/RHSA-2026:72491"}],"tags":["nvd","cve.org","exploit-available","csaf","vex","red-hat"],"epss":0.00917,"epssPercentile":0.60016,"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"partial","timestamp":"2026-09-18T12:58:19.479020Z"},"ingestedAt":"2026-09-17T23:31:20.694Z","patched":["hardened_images"],"slug":"CVE-2026-93450","body":"## Overview\n\ngo-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON parsing and serialization due to unbounded recursion with no depth limit. Remote unauthenticated attackers can submit deeply nested JSON documents to services accepting OpenAPI specifications, causing fatal stack overflow that terminates the process and all in-flight requests.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2026:72488** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:72488)\n- **RHSA-2026:72497** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:72497)\n- **RHSA-2026:74871** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-10-02 · [advisory](https://access.redhat.com/errata/RHSA-2026:74871)\n- **RHSA-2026:72498** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:72498)\n- **RHSA-2026:71906** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:71906)\n- **RHSA-2026:72507** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:72507)\n- **RHSA-2026:85266** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:85266)\n- **RHSA-2026:68717** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68717)\n- **RHSA-2026:68729** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68729)\n- **RHSA-2026:72570** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:72570)\n- **RHSA-2026:72496** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:72496)\n- **Red Hat VEX** · Important · affected: Red Hat Hardened Images · no fix planned: Red Hat Hardened Images · updated 2026-10-20 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93450.json)","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":41.3,"likelihood":0.2,"exploitation":12,"ransomware":0},"changes":[{"seq":206823,"id":"CVE-2026-93450","ts":1789738967936,"field":"exploit_available","old":"false","new":"true"}]}