Executive brief
go-openapi/swag is a utility library used by API services to parse and serialize OpenAPI specifications in JSON format. A stack overflow vulnerability in versions before 0.27.1 allows remote attackers to submit deeply nested JSON documents that cause the service to crash, terminating all active requests and causing service outages without requiring any authentication.
Technical details
The vulnerability is a stack overflow caused by unbounded recursion during ordered JSON parsing and serialization in the jsonutils component of go-openapi/swag. The parser lacks depth limits and will recursively process deeply nested JSON structures without terminating, eventually exhausting the stack. Remote attackers can exploit this by submitting specially crafted OpenAPI specifications with excessive JSON nesting to any service using this library. Successful exploitation results in a fatal stack overflow that crashes the process, causing denial of service for all in-flight requests. The fix is available in version 0.27.1 and later.
Affected products
- go-openapi swag before 0.27.1
Timeline
- 2026-09-18: disclosed