CVE-2025-30153 Improper Handling of Highly Compressed Data (Data Amplification) in github.com/getkin/kin-openapi/openapi3filter
An attacker can cause a denial of service by uploading a crafted ZIP bomb to a server using the kin-openapi library for request validation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-30153?
CVE-2025-30153 is a high-severity denial of service vulnerability in getkin kin-openapi, published on 19 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.131.0, when validating a request with a multipart/form-data schema, if the OpenAPI schema allows it, an attacker can upload a crafted ZIP file (e.g., a ZIP bomb), causing the server to consume all available system memory. The root cause comes from the ZipFileBodyDecoder, which is registered automatically by the module (contrary to what the documentation says). This vulnerability is fixed in 0.131.0.
Weakness: CWE-409
Which versions are affected by CVE-2025-30153?
3 open source packages ship an affected version, including github.com/getkin/kin-openapi.
| Package | Affected | Fixed in |
|---|---|---|
github.com/getkin/kin-openapi Go | All versions | 0.131.0 |
github.com/getkin/kin-openapi Go | All versions | 0.131.0 |
github.com/getkin/kin-openapi Go | All versions | 0.131.0 |
Linux distribution packages (1)
grafana openSUSE:Tumbleweed | All versions | 11.6.14+security01-4.1 |
How do I fix CVE-2025-30153?
Upgrade github.com/getkin/kin-openapi to 0.131.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-30153 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-30153 exists.
Sources
Also known as CLEANSTART-2026-WF39253, CLEANSTART-2026-XI97972, DEBIAN-CVE-2025-30153, GHSA-wq9g-9vfc-cfq9, GO-2025-3533, MINI-j5h2-f9hg-6wwg and 5 more.