CVE-2026-93450Disclosure

LOWCVSS 8.7 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON parsing and serialization due to unbounded recursion with no depth limit. Remote unauthenticated attackers can submit deeply nested JSON documents to services accepting OpenAPI specifications, causing fatal stack overflow that terminates the process and all in-flight requests.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-674

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

Patch or workaround signal is available
2 mentions across 1 observed day

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 2 signals
Disclosure: 1 classified signal
2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d

Signal classification2 categories

Disclosure

150.0%

Patch

150.0%

Referenced assets2 URLs

By indicator

Full discourse2 posts

Upwind Security MDR@UpwindMDR45d
Patch
🚨HIGH - go-openapi/swag jsonutils Stack Overflow DoS via Deeply Nested JSON (CVE-2026-93450) go-openapi/swag/jsonutils ordered JSON parsing/serialization uses unbounded recursion (no depth limit). Remote unauthenticated attackers can feed deeply nested JSON (e.g., OpenAPI spec payloads) to trigger a fatal stack overflow, crashing the process and dropping in-flight requests. 👉Affected: http://github.com/go-openapi/swag/jsonutils < 0.27.1 | Upgrade to 0.27.1
Post summary
The text announces a DoS vulnerability in go-openapi/swag/jsonutils (CVE-2026-93450) and explicitly recommends upgrading to version 0.27.1 to mitigate the stack overflow risk.
0001087
305 followersView on X
CVE@CVEnew46d
Disclosure
CVE-2026-93450 go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON parsing and serialization due to unbounded recursion with no depth lim… https://www.cve.org/CVERecord?id=CVE-2026-93450
Post summary
The tweet discloses CVE-2026-93450, a stack overflow vulnerability in go-openapi/swag jsonutils versions prior to 0.27.1 caused by unbounded recursion during JSON parsing. No exploit, patch, or active exploitation is mentioned.
00000909
58.1K followersView on X

Explore more

Back to dashboard