CVE-2026-93450
go-openapi/swag jsonutils before 0.27.1 Uncontrolled Recursion in Ordered JSON Marshal and Unmarshal
go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON parsing and serialization due to unbounded recursion with no depth limit. Remote unauthenticated attackers can submit deeply nested JSON documents to services accepting OpenAPI specifications, causing fatal stack overflow that terminates the process and all in-flight requests.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
go-openapi/swag jsonutils before 0.27.1 Uncontrolled Recursion in Ordered JSON Marshal and Unmarshal
go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON parsing and serialization due to unbounded recursion with no depth limit. Remote unauthenticated attackers can submit deeply nested JSON documents to services accepting OpenAPI specifications, causing fatal stack overflow that terminates the process and all in-flight requests.
- Record
CVE-2026-93450- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-674
- Updated
- 2026-11-02
EUVDEUVD-2026-82602
go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON parsing and serialization due to unbounded recursion with no depth limit. Remote unauthenticated attackers can submit deeply nested JSON documents to services accepting OpenAPI specifications, causing fatal stack overflow that terminates the process and all in-flight requests.
- Record
EUVD-2026-82602- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-j354-7hcm-wg69
go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON...
go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON parsing and serialization due to unbounded recursion with no depth limit. Remote unauthenticated attackers can submit deeply nested JSON documents to services accepting OpenAPI specifications, causing fatal stack overflow that terminates the process and all in-flight requests.
- Record
GHSA-j354-7hcm-wg69- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-674
- Updated
- 2026-11-02
NVD
go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON parsing and serialization due to unbounded recursion with no depth limit. Remote unauthenticated attackers can submit deeply nested JSON documents to services accepting OpenAPI specifications, causing fatal stack overflow that terminates the process and all in-flight requests.
- Record
CVE-2026-93450- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-674
- Updated
- 2026-11-02
OSV
go-openapi/swag jsonutils before 0.27.1 Uncontrolled Recursion in Ordered JSON Marshal and Unmarshal
go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON parsing and serialization due to unbounded recursion with no depth limit. Remote unauthenticated attackers can submit deeply nested JSON documents to services accepting OpenAPI specifications, causing fatal stack overflow that terminates the process and all in-flight requests.
- Record
CVE-2026-93450- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-674
- Updated
- 2026-11-02
OSVRHSA-2026:68272
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- Record
RHSA-2026:68272- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 21 moreShow less
OSVRHSA-2026:68290
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- Record
RHSA-2026:68290- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:68591
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- Record
RHSA-2026:68591- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2026:68717
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
- Record
RHSA-2026:68717- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2026:68729
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
- Record
RHSA-2026:68729- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2026:71906
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
- Record
RHSA-2026:71906- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2026:72488
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
- Record
RHSA-2026:72488- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2026:72489
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
- Record
RHSA-2026:72489- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2026:72490
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
- Record
RHSA-2026:72490- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2026:72491
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
- Record
RHSA-2026:72491- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2026:72492
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
- Record
RHSA-2026:72492- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2026:72493
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
- Record
RHSA-2026:72493- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2026:72496
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
- Record
RHSA-2026:72496- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2026:72497
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
- Record
RHSA-2026:72497- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2026:72498
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
- Record
RHSA-2026:72498- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:72507
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
- Record
RHSA-2026:72507- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:72570
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
- Record
RHSA-2026:72570- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2026:72750
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
- Record
RHSA-2026:72750- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:74871
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
- Record
RHSA-2026:74871- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H - Updated
- 2026-11-02
OSVRHSA-2026:85266
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
- Record
RHSA-2026:85266- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVAZL-103377 No score
CVE-2026-93450 affecting package kubevirt for versions less than 1.8.4-4
go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON parsing and serialization due to unbounded recursion with no depth limit. Remote unauthenticated attackers can submit deeply nested JSON documents to services accepting OpenAPI specifications, causing fatal stack overflow that terminates the process and all in-flight requests.
- Record
AZL-103377- Updated
- 2026-11-05
OSVAZL-111656 No score
CVE-2026-93450 affecting package kubevirt-openvmm 1.9.0-1
go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON parsing and serialization due to unbounded recursion with no depth limit. Remote unauthenticated attackers can submit deeply nested JSON documents to services accepting OpenAPI specifications, causing fatal stack overflow that terminates the process and all in-flight requests.
- Record
AZL-111656- Updated
- 2026-11-05
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
kubevirtAzure Linux:3 |
before 1.8.4-4 | 1.8.4-4 |
kubevirt-openvmmAzure Linux:3 |
through 1.9.0-1 | None known |
opentelemetry-collectorRed Hat:hummingbird:1 From an advisory covering 3 CVEs |
before 0:0.161.0-0.1.hum1 | 0:0.161.0-0.1.hum1 |
opentelemetry-collector-contribRed Hat:hummingbird:1 From an advisory covering 10 CVEs |
before 0:0.161.0-0.1.hum1 | 0:0.161.0-0.1.hum1 |
opentelemetry-collector-k8sRed Hat:hummingbird:1 From an advisory covering 3 CVEs |
before 0:0.161.0-0.1.hum1 | 0:0.161.0-0.1.hum1 |
helm3Red Hat:hummingbird:1 From an advisory covering 5 CVEs |
before 0:3.22.0-0.2.hum1 | 0:3.22.0-0.2.hum1 |
helm4Red Hat:hummingbird:1 From an advisory covering 5 CVEs |
before 0:4.3.0-0.2.hum1 | 0:4.3.0-0.2.hum1 |
grafana13.2Red Hat:hummingbird:1 From an advisory covering 4 CVEs |
before 0:13.2.1-0.7.hum1 | 0:13.2.1-0.7.hum1 |
cosignRed Hat:hummingbird:1 |
before 0:3.1.3-0.2.hum1 | 0:3.1.3-0.2.hum1 |
spire1.14Red Hat:hummingbird:1 From an advisory covering 2 CVEs |
before 0:1.14.7-0.5.hum1 | 0:1.14.7-0.5.hum1 |
Show 22 moreShow less
| Package | Affected | Fixed |
|---|---|---|
spire1.14-agentRed Hat:hummingbird:1 From an advisory covering 2 CVEs |
before 0:1.14.7-0.5.hum1 | 0:1.14.7-0.5.hum1 |
spire1.14-oidc-discovery-providerRed Hat:hummingbird:1 From an advisory covering 2 CVEs |
before 0:1.14.7-0.5.hum1 | 0:1.14.7-0.5.hum1 |
spire1.14-serverRed Hat:hummingbird:1 From an advisory covering 2 CVEs |
before 0:1.14.7-0.5.hum1 | 0:1.14.7-0.5.hum1 |
tempo2.10Red Hat:hummingbird:1 From an advisory covering 2 CVEs |
before 0:2.10.8-0.4.hum1 | 0:2.10.8-0.4.hum1 |
tempo3.0Red Hat:hummingbird:1 From an advisory covering 2 CVEs |
before 0:3.0.3-0.4.hum1 | 0:3.0.3-0.4.hum1 |
trivyRed Hat:hummingbird:1 From an advisory covering 3 CVEs |
before 0:0.74.0-0.4.hum1 | 0:0.74.0-0.4.hum1 |
spire1.15Red Hat:hummingbird:1 From an advisory covering 3 CVEs |
before 0:1.15.3-0.2.hum1 | 0:1.15.3-0.2.hum1 |
spire1.15-agentRed Hat:hummingbird:1 From an advisory covering 3 CVEs |
before 0:1.15.3-0.2.hum1 | 0:1.15.3-0.2.hum1 |
spire1.15-oidc-discovery-providerRed Hat:hummingbird:1 From an advisory covering 3 CVEs |
before 0:1.15.3-0.2.hum1 | 0:1.15.3-0.2.hum1 |
spire1.15-serverRed Hat:hummingbird:1 From an advisory covering 3 CVEs |
before 0:1.15.3-0.2.hum1 | 0:1.15.3-0.2.hum1 |
loki3.7Red Hat:hummingbird:1 From an advisory covering 4 CVEs |
before 0:3.7.8-0.3.hum1 | 0:3.7.8-0.3.hum1 |
loki3.7-canaryRed Hat:hummingbird:1 From an advisory covering 4 CVEs |
before 0:3.7.8-0.3.hum1 | 0:3.7.8-0.3.hum1 |
loki3.7-logcliRed Hat:hummingbird:1 From an advisory covering 4 CVEs |
before 0:3.7.8-0.3.hum1 | 0:3.7.8-0.3.hum1 |
grafana12.4Red Hat:hummingbird:1 From an advisory covering 3 CVEs |
before 0:12.4.10-0.9.hum1 | 0:12.4.10-0.9.hum1 |
grafana13.1Red Hat:hummingbird:1 From an advisory covering 4 CVEs |
before 0:13.1.6-0.4.hum1 | 0:13.1.6-0.4.hum1 |
grafana13.2Red Hat:hummingbird:1 From an advisory covering 4 CVEs |
before 0:13.2.1-0.8.hum1 | 0:13.2.1-0.8.hum1 |
loki3.6Red Hat:hummingbird:1 From an advisory covering 5 CVEs |
before 0:3.6.17-0.3.hum1 | 0:3.6.17-0.3.hum1 |
loki3.6-canaryRed Hat:hummingbird:1 From an advisory covering 5 CVEs |
before 0:3.6.17-0.3.hum1 | 0:3.6.17-0.3.hum1 |
loki3.6-logcliRed Hat:hummingbird:1 From an advisory covering 5 CVEs |
before 0:3.6.17-0.3.hum1 | 0:3.6.17-0.3.hum1 |
prometheus3.13Red Hat:hummingbird:1 From an advisory covering 3 CVEs |
before 0:3.13.3-0.2.hum1 | 0:3.13.3-0.2.hum1 |
grafana12.4Red Hat:hummingbird:1 From an advisory covering 12 CVEs |
before 0:12.4.12-0.3.hum1 | 0:12.4.12-0.3.hum1 |
grafana13.2Red Hat:hummingbird:1 From an advisory covering 9 CVEs |
before 0:13.2.3-0.3.hum1 | 0:13.2.3-0.3.hum1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-93450 is a high vulnerability (CVSS 8.7) in Go-openapi Swag, published September 17, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.32%, the 70th percentile. Fixed in kubevirt 1.8.4-4.
References
github.com/go-openapi/swag/security/advisories/GHSA-xh24-9qpg-8w28
vulncheck.com/advisories/go-openapi-swag-jsonutils-before-0.27.1-uncontrolled-recursion-in-ordered-json-marshal-and-unmarshal
Show 194 moreShow less
nvd.nist.gov/vuln/detail/CVE-2026-93450
proxy.golang.org
access.redhat.com/errata/RHSA-2026:68272
images.redhat.com
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68272.json
bugzilla.redhat.com/show_bug.cgi?id=2543236
cve.org/CVERecord?id=CVE-2026-63209
go.dev/cl/793360
pkg.go.dev/vuln/GO-2026-6629
cna.openjsf.org/security-advisories.html
groups.google.com/g/golang-announce/c/ArQ6CDgtEjY
security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-16874025
npmjs.com/package/shell-quote
grafana.com/security/security-advisories/cve-2026-81842
Left out here: 113 references. The JSON record has them.