Description
go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON parsing and serialization due to unbounded recursion with no depth limit. Remote unauthenticated attackers can submit deeply nested JSON documents to services accepting OpenAPI specifications, causing fatal stack overflow that terminates the process and all in-flight requests.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| go-openapi | swag | < 0.27.1 | 0.27.1 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | cosign | 3.1.3-0.2.hum1 | RHSA-2026:72488 |
| Red Hat Hardened Images 1 | grafana12.4 | 12.4.10-0.9.hum1 | RHSA-2026:74871, RHSA-2026:72497 |
| Red Hat Hardened Images 1 | grafana13.1 | 13.1.6-0.4.hum1 | RHSA-2026:72498 |
| Red Hat Hardened Images 1 | grafana13.2 | 13.2.1-0.7.hum1 | RHSA-2026:85266, RHSA-2026:72507, RHSA-2026:71906 |
| Red Hat Hardened Images 1 | helm3 | 3.22.0-0.2.hum1 | RHSA-2026:68717 |
| Red Hat Hardened Images 1 | helm4 | 4.3.0-0.2.hum1 | RHSA-2026:68729 |
| Red Hat Hardened Images 1 | loki3.6 +2 | 3.6.17-0.3.hum1 | RHSA-2026:72570 |
| Red Hat Hardened Images 1 | loki3.7 +2 | 3.7.8-0.3.hum1 | RHSA-2026:72496 |
| Red Hat Hardened Images 1 | opentelemetry-collector +2 | 0.161.0-0.1.hum1 | RHSA-2026:68591, RHSA-2026:68290, RHSA-2026:68272 |
| Red Hat Hardened Images 1 | prometheus3.13 | 3.13.3-0.2.hum1 | RHSA-2026:72750 |
| Red Hat Hardened Images 1 | spire1.14 +3 | 1.14.7-0.5.hum1 | RHSA-2026:72489 |
| Red Hat Hardened Images 1 | spire1.15 +3 | 1.15.3-0.2.hum1 | RHSA-2026:72493 |
| Red Hat Hardened Images 1 | tempo2.10 | 2.10.8-0.4.hum1 | RHSA-2026:72490 |
| Red Hat Hardened Images 1 | tempo3.0 | 3.0.3-0.4.hum1 | RHSA-2026:72491 |
| Red Hat Hardened Images 1 | trivy | 0.74.0-0.4.hum1 | RHSA-2026:72492 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | runfinch-finch | 1.19.0-1.amzn2023.0.4 | ALAS2023-2026-3395 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | kubevirt | 1.8.4-4 | — |
| Azure Linux 3 | kubevirt-openvmm | No fix yet | — |
Advisories 21
- ALAS2023-2026-3395 Important: runfinch-finch security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 9, 2026
- RHSA-2026:72570 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:72491 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:72750 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:72492 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:68717 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:85266 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:68290 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:68591 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:74871 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:72496 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:71906 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:72490 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:72498 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:72489 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:72507 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:72493 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:68272 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:68729 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:72497 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:72488 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
References
- GitHub Security Advisory (GHSA-xh24-9qpg-8w28) vendor-advisory
- https://github.com/go-openapi/swag/commit/0c24346ced59a25811e8694a915e7131d25ccb0e patch
- https://github.com/go-openapi/swag/blob/v0.27.0/jsonutils/adapters/stdlib/json/adapter.go#L68 technical-description
- https://github.com/go-openapi/swag/blob/v0.27.0/jsonutils/adapters/stdlib/json/ordered_map.go#L214 technical-description
- https://github.com/go-openapi/swag product
- VulnCheck Advisory: go-openapi/swag jsonutils before 0.27.1 Uncontrolled Recursion in Ordered JSON Marshal and Unmarshal third-party-advisory