CVE-2026-93450 go-openapi/swag jsonutils before 0.27.1 Uncontrolled Recursion in Ordered JSON Marshal and Unmarshal
Remote attackers can cause a stack overflow and crash services by submitting deeply nested JSON documents to applications using this Go library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-93450?
CVE-2026-93450 is a high-severity denial of service vulnerability in go-openapi swag, published on 17 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON parsing and serialization due to unbounded recursion with no depth limit. Remote unauthenticated attackers can submit deeply nested JSON documents to services accepting OpenAPI specifications, causing fatal stack overflow that terminates the process and all in-flight requests.
Weakness: CWE-674
Which versions are affected by CVE-2026-93450?
Linux distribution packages (1)
cosign Red Hat:hummingbird:1 | All versions | 0:3.1.3-0.2.hum1 |
How do I fix CVE-2026-93450?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-93450 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-93450 exists.
Sources
Also known as AZL-103377, GHSA-j354-7hcm-wg69, GHSA-xh24-9qpg-8w28, RHSA-2026:72488.