CVE-2025-30153: kin-openapi DOS Vulnerability

CVE-2025-30153 Overview

CVE-2025-30153 is a resource exhaustion vulnerability in kin-openapi, a Go project for handling OpenAPI files. Prior to version 0.131.0, when validating a request with a multipart/form-data schema, if the OpenAPI schema allows it, an attacker can upload a crafted ZIP file (e.g., a ZIP bomb), causing the server to consume all available system memory. The root cause comes from the ZipFileBodyDecoder, which is registered automatically by the module contrary to what the documentation states.

Critical Impact
This vulnerability allows unauthenticated remote attackers to cause complete denial of service by uploading a malicious ZIP bomb that exhausts all available system memory, potentially crashing the application and affecting system availability.

Affected Products

kin-openapi versions prior to 0.131.0
Go applications using kin-openapi with multipart/form-data request validation
Services accepting ZIP file uploads through OpenAPI-validated endpoints

Discovery Timeline

2025-03-19 - CVE-2025-30153 published to NVD
2025-03-19 - Last updated in NVD database

Technical Details for CVE-2025-30153

Vulnerability Analysis

This vulnerability falls under CWE-409 (Improper Handling of Highly Compressed Data), commonly known as a decompression bomb or ZIP bomb attack. The kin-openapi library automatically registers a ZipFileBodyDecoder for handling application/zip content types during request validation. When processing multipart form data, the decoder attempts to decompress uploaded ZIP files without implementing proper safeguards against highly compressed malicious archives.

A ZIP bomb is a maliciously crafted archive file designed to crash or render useless the program or system reading it. These files can achieve extreme compression ratios, with archives of just a few kilobytes expanding to petabytes of data when decompressed. When the vulnerable ZipFileBodyDecoder processes such a file, it attempts to read the entire decompressed content into memory, leading to memory exhaustion.

Root Cause

The vulnerability originates from the automatic registration of zipFileBodyDecoder in the init() function of req_resp_decoder.go. Despite documentation suggesting that custom content type decoders need to be explicitly registered, the ZIP decoder was registered by default. This decoder lacks proper bounds checking or streaming limits when decompressing ZIP archives, allowing maliciously crafted compressed files to consume unbounded memory during the validation process.

Attack Vector

An attacker can exploit this vulnerability remotely without authentication by sending a multipart/form-data request containing a ZIP bomb to any endpoint that:

Uses kin-openapi for request validation
Has an OpenAPI schema that permits ZIP file uploads
Runs a vulnerable version of the library (prior to 0.131.0)

The attack requires only network access to the target application and a crafted ZIP file, making it highly accessible to potential attackers.

// Security patch in openapi3filter/req_resp_decoder.go
// The fix removes automatic registration of zipFileBodyDecoder

	RegisterBodyDecoder("application/vnd.api+json", JSONBodyDecoder)
	RegisterBodyDecoder("application/octet-stream", FileBodyDecoder)
	RegisterBodyDecoder("application/problem+json", JSONBodyDecoder)
-	RegisterBodyDecoder("application/x-www-form-urlencoded", urlencodedBodyDecoder)
-	RegisterBodyDecoder("application/x-yaml", yamlBodyDecoder)
-	RegisterBodyDecoder("application/yaml", yamlBodyDecoder)
-	RegisterBodyDecoder("application/zip", zipFileBodyDecoder)
-	RegisterBodyDecoder("multipart/form-data", multipartBodyDecoder)
-	RegisterBodyDecoder("text/csv", csvBodyDecoder)
-	RegisterBodyDecoder("text/plain", plainBodyDecoder)
+	RegisterBodyDecoder("application/x-www-form-urlencoded", UrlencodedBodyDecoder)
+	RegisterBodyDecoder("application/x-yaml", YamlBodyDecoder)
+	RegisterBodyDecoder("application/yaml", YamlBodyDecoder)
+	RegisterBodyDecoder("multipart/form-data", MultipartBodyDecoder)
+	RegisterBodyDecoder("text/csv", CsvBodyDecoder)
+	RegisterBodyDecoder("text/plain", PlainBodyDecoder)
}

Source: GitHub Commit Reference

Detection Methods for CVE-2025-30153

Indicators of Compromise

Sudden spikes in memory consumption on servers handling file uploads
Application crashes or out-of-memory errors coinciding with file upload requests
Abnormally small ZIP files (few KB) in upload logs that trigger high resource usage
Server unresponsiveness following multipart/form-data requests

Detection Strategies

Monitor application memory usage patterns and alert on rapid, unexplained increases during request processing
Implement request logging that captures file sizes and content types for multipart uploads
Audit Go dependencies using go list -m all | grep kin-openapi to identify vulnerable versions
Use software composition analysis (SCA) tools to detect vulnerable kin-openapi versions in your dependency tree

Monitoring Recommendations

Configure memory limits and OOM kill thresholds for services processing file uploads
Implement application performance monitoring (APM) with memory usage alerts
Enable detailed logging for multipart/form-data request handlers to track upload patterns
Set up automated vulnerability scanning in CI/CD pipelines to catch vulnerable dependencies

How to Mitigate CVE-2025-30153

Immediate Actions Required

Upgrade kin-openapi to version 0.131.0 or later immediately
Review OpenAPI schemas to identify endpoints accepting ZIP file uploads
Implement request body size limits at the web server or reverse proxy level
Consider temporarily disabling ZIP file upload functionality until patches are applied

Patch Information

The vulnerability is fixed in kin-openapi version 0.131.0. The fix removes the automatic registration of zipFileBodyDecoder and makes several decoders public, allowing developers to explicitly register only the decoders they need. The security patch is available via the GitHub Commit. For detailed information about this vulnerability, refer to the GitHub Security Advisory.

Workarounds

If immediate upgrade is not possible, manually unregister the ZIP decoder using UnregisterBodyDecoder("application/zip")
Implement request body size limits at the infrastructure level (reverse proxy, load balancer)
Add server-side validation to reject ZIP files before they reach kin-openapi validation
Use custom content type handlers as described in the kin-openapi documentation

bash

# Update kin-openapi to the patched version
go get github.com/getkin/kin-openapi@v0.131.0
go mod tidy

# Verify the installed version
go list -m github.com/getkin/kin-openapi