CVE-2026-93450

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-93450
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93450.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-93450
Aliases
  • GHSA-xh24-9qpg-8w28
Published
2026-09-17T23:25:10Z
Modified
2026-09-20T11:30:34Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
go-openapi/swag jsonutils before 0.27.1 Uncontrolled Recursion in Ordered JSON Marshal and Unmarshal
Details

go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON parsing and serialization due to unbounded recursion with no depth limit. Remote unauthenticated attackers can submit deeply nested JSON documents to services accepting OpenAPI specifications, causing fatal stack overflow that terminates the process and all in-flight requests.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-674"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93450.json"
}
References

Affected packages

Git / github.com/go-openapi/swag

Affected ranges

Type
GIT
Repo
https://github.com/go-openapi/swag
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
c8a41f7226ee09d8f74ac3e9375d071041836b7c
Fixed
0c24346ced59a25811e8694a915e7131d25ccb0e
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.27.1"
        }
    ],
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.15.0
0.16.0
cmdutils/v0.*
cmdutils/v0.24.0
cmdutils/v0.25.0
cmdutils/v0.25.1
cmdutils/v0.25.2
cmdutils/v0.25.3
cmdutils/v0.25.4
cmdutils/v0.25.5
cmdutils/v0.26.0
cmdutils/v0.26.1
cmdutils/v0.27.0
conv/v0.*
conv/v0.24.0
conv/v0.25.0
conv/v0.25.1
conv/v0.25.2
conv/v0.25.3
conv/v0.25.4
conv/v0.25.5
conv/v0.26.0
conv/v0.26.1
conv/v0.27.0
fileutils/v0.*
fileutils/v0.24.0
fileutils/v0.25.0
fileutils/v0.25.1
fileutils/v0.25.2
fileutils/v0.25.3
fileutils/v0.25.4
fileutils/v0.25.5
fileutils/v0.26.0
fileutils/v0.26.1
fileutils/v0.27.0
jsonname/v0.*
jsonname/v0.24.0
jsonname/v0.25.0
jsonname/v0.25.1
jsonname/v0.25.2
jsonname/v0.25.3
jsonname/v0.25.4
jsonname/v0.25.5
jsonname/v0.26.0
jsonname/v0.26.1
jsonname/v0.27.0
jsonutils/adapters/easyjson/v0.*
jsonutils/adapters/easyjson/v0.25.0
jsonutils/adapters/easyjson/v0.25.1
jsonutils/adapters/easyjson/v0.25.2
jsonutils/adapters/easyjson/v0.25.3
jsonutils/adapters/easyjson/v0.25.4
jsonutils/adapters/easyjson/v0.25.5
jsonutils/adapters/easyjson/v0.26.0
jsonutils/adapters/easyjson/v0.26.1
jsonutils/adapters/easyjson/v0.27.0
jsonutils/adapters/testintegration/benchmarks/v0.*
jsonutils/adapters/testintegration/benchmarks/v0.25.0
jsonutils/adapters/testintegration/benchmarks/v0.25.1
jsonutils/adapters/testintegration/benchmarks/v0.25.2
jsonutils/adapters/testintegration/benchmarks/v0.25.3
jsonutils/adapters/testintegration/benchmarks/v0.25.4
jsonutils/adapters/testintegration/benchmarks/v0.25.5
jsonutils/adapters/testintegration/benchmarks/v0.26.0
jsonutils/adapters/testintegration/benchmarks/v0.26.1
jsonutils/adapters/testintegration/benchmarks/v0.27.0
jsonutils/adapters/testintegration/v0.*
jsonutils/adapters/testintegration/v0.25.0
jsonutils/adapters/testintegration/v0.25.1
jsonutils/adapters/testintegration/v0.25.2
jsonutils/adapters/testintegration/v0.25.3
jsonutils/adapters/testintegration/v0.25.4
jsonutils/adapters/testintegration/v0.25.5
jsonutils/adapters/testintegration/v0.26.0
jsonutils/adapters/testintegration/v0.26.1
jsonutils/adapters/testintegration/v0.27.0
jsonutils/fixtures_test/v0.*
jsonutils/fixtures_test/v0.25.0
jsonutils/fixtures_test/v0.25.1
jsonutils/fixtures_test/v0.25.2
jsonutils/fixtures_test/v0.25.3
jsonutils/fixtures_test/v0.25.4
jsonutils/fixtures_test/v0.25.5
jsonutils/fixtures_test/v0.26.0
jsonutils/fixtures_test/v0.26.1
jsonutils/fixtures_test/v0.27.0
jsonutils/v0.*
jsonutils/v0.24.0
jsonutils/v0.25.0
jsonutils/v0.25.1
jsonutils/v0.25.2
jsonutils/v0.25.3
jsonutils/v0.25.4
jsonutils/v0.25.5
jsonutils/v0.26.0
jsonutils/v0.26.1
jsonutils/v0.27.0
loading/v0.*
loading/v0.24.0
loading/v0.25.0
loading/v0.25.1
loading/v0.25.2
loading/v0.25.3
loading/v0.25.4
loading/v0.25.5
loading/v0.26.0
loading/v0.26.1
loading/v0.27.0
mangling/v0.*
mangling/v0.24.0
mangling/v0.25.0
mangling/v0.25.1
mangling/v0.25.2
mangling/v0.25.3
mangling/v0.25.4
mangling/v0.25.5
mangling/v0.26.0
mangling/v0.26.1
mangling/v0.27.0
netutils/v0.*
netutils/v0.24.0
netutils/v0.25.0
netutils/v0.25.1
netutils/v0.25.2
netutils/v0.25.3
netutils/v0.25.4
netutils/v0.25.5
netutils/v0.26.0
netutils/v0.26.1
netutils/v0.27.0
pools/v0.*
pools/v0.27.0
stringutils/v0.*
stringutils/v0.24.0
stringutils/v0.25.0
stringutils/v0.25.1
stringutils/v0.25.2
stringutils/v0.25.3
stringutils/v0.25.4
stringutils/v0.25.5
stringutils/v0.26.0
stringutils/v0.26.1
stringutils/v0.27.0
typeutils/v0.*
typeutils/v0.24.0
typeutils/v0.25.0
typeutils/v0.25.1
typeutils/v0.25.2
typeutils/v0.25.3
typeutils/v0.25.4
typeutils/v0.25.5
typeutils/v0.26.0
typeutils/v0.26.1
typeutils/v0.27.0
v0.*
v0.17.0
v0.17.1
v0.17.2
v0.18.0
v0.19.0
v0.19.10
v0.19.11
v0.19.12
v0.19.13
v0.19.14
v0.19.15
v0.19.2
v0.19.3
v0.19.4
v0.19.5
v0.19.6
v0.19.7
v0.19.8
v0.19.9
v0.20.0
v0.21.0
v0.21.1
v0.22.0
v0.22.1
v0.22.10
v0.22.2
v0.22.3
v0.22.4
v0.22.5
v0.22.6
v0.22.7
v0.22.8
v0.22.9
v0.23.0
v0.23.1
v0.24.0
v0.24.1
v0.25.0
v0.25.1
v0.25.2
v0.25.3
v0.25.4
v0.25.5
v0.26.0
v0.26.1
v0.27.0
yamlutils/v0.*
yamlutils/v0.24.0
yamlutils/v0.25.0
yamlutils/v0.25.1
yamlutils/v0.25.2
yamlutils/v0.25.3
yamlutils/v0.25.4
yamlutils/v0.25.5
yamlutils/v0.26.0
yamlutils/v0.26.1
yamlutils/v0.27.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93450.json"