CVE-2026-93450: go-openapi/swag DOS Vulnerability

CVE-2026-93450 Overview

CVE-2026-93450 is a stack overflow vulnerability in the go-openapi/swag library's jsonutils package affecting versions before 0.27.1. The flaw stems from unbounded recursion with no depth limit in the ordered JSON marshaling and unmarshaling routines. Remote unauthenticated attackers can submit deeply nested JSON documents to services that accept OpenAPI specifications. The recursive parser exhausts the goroutine stack and triggers a fatal Go runtime panic. That panic cannot be recovered and terminates the entire process, dropping all in-flight requests. The vulnerability is tracked as uncontrolled recursion [CWE-674].

Critical Impact
A single crafted JSON payload can crash any Go service that uses go-openapi/swag jsonutils to parse untrusted OpenAPI or JSON input, causing a full process-level denial of service.

Affected Products

github.com/go-openapi/swag/jsonutils versions prior to 0.27.1
Go applications and services that parse OpenAPI specifications using the affected package
Downstream libraries and tooling that depend on go-openapi/swag for ordered JSON handling

Discovery Timeline

2026-09-18 - CVE-2026-93450 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-93450

Vulnerability Analysis

The jsonutils package in go-openapi/swag provides an ordered JSON marshaler and unmarshaler used to preserve key order in OpenAPI documents. The parser walks nested JSON containers, objects ({}) and arrays ([]), using direct function recursion. Prior to 0.27.1, the implementation applied no ceiling on how deeply it would descend.

When an attacker submits a payload consisting of thousands of nested containers, the Go runtime cannot grow the goroutine stack indefinitely. The runtime raises a fatal runtime: goroutine stack exceeds error. Unlike a standard Go panic, this fatal error bypasses recover() and terminates the process. Any concurrent requests handled by the same process are dropped.

Root Cause

The root cause is missing depth tracking in the recursive descent parser in jsonutils/adapters/stdlib/json/adapter.go and ordered_map.go. The standard library's encoding/json decoder enforces a hard nesting limit of 10000 to prevent this exact class of crash. The swag ordered variant did not mirror that guard, leaving any consumer exposed to unbounded recursion [CWE-674].

Attack Vector

Exploitation requires only network access to an endpoint that feeds attacker-controlled input into the affected parser. No authentication and no user interaction are required. Common attack surfaces include API gateways, schema validators, developer tooling, and any service that ingests OpenAPI documents from clients or third parties.

The fix bounds recursion using a defaultMaxNestingDepth constant, matching the standard library's behavior:

package json

// defaultMaxNestingDepth is the default maximum number of nested JSON containers
// ('{' or '[') that the ordered-JSON marshaler and unmarshaler will process before
// returning an error.
//
// It mirrors the limit enforced by the standard library's [encoding/json] decoder,
// guarding against stack-overflow crashes on deeply nested (possibly adversarial) input.
const defaultMaxNestingDepth = 10000

// Option selects options for the easyjson adapter.
type Option func(o *options)

Source: GitHub Go-OpenAPI Commit 0c24346

Detection Methods for CVE-2026-93450

Indicators of Compromise

Unexpected process termination of Go services with runtime: goroutine stack exceeds messages in stdout or stderr
Repeated service restarts by supervisors (systemd, Kubernetes liveness restarts) correlated with inbound JSON traffic
HTTP request logs showing large payloads with extreme nesting depth immediately before crash events

Detection Strategies

Perform software composition analysis on Go modules to identify github.com/go-openapi/swag versions below 0.27.1 in go.mod and go.sum files
Deploy a web application firewall or reverse proxy rule that rejects JSON bodies containing an abnormal count of consecutive { or [ characters
Correlate application crash telemetry with request payload size and nesting metrics to identify probing attempts

Monitoring Recommendations

Monitor Go runtime fatal-error logs and container exit codes across all services parsing external JSON or OpenAPI input
Track request-level metrics for JSON payload depth at the ingress layer and alert on outliers
Watch dependency dashboards for advisory GHSA-xh24-9qpg-8w28 alerts across CI/CD pipelines

How to Mitigate CVE-2026-93450

Immediate Actions Required

Upgrade github.com/go-openapi/swag to version 0.27.1 or later in all Go projects and rebuild affected binaries
Audit all direct and transitive dependencies for the vulnerable package using go list -m all and rebuild container images
Enforce request body size limits at ingress controllers and API gateways to reduce the attack surface

Patch Information

The fix is delivered in commit 0c24346ced59a25811e8694a915e7131d25ccb0e and released in version 0.27.1. The patch introduces a defaultMaxNestingDepth constant of 10000 and returns an error when the parser exceeds that depth, matching the behavior of the standard library's encoding/json decoder. Full details are available in the GitHub Security Advisory GHSA-xh24-9qpg-8w28 and the VulnCheck Go-OpenAPI Swag Advisory.

Workarounds

Place a JSON-aware proxy in front of affected services that validates and caps nesting depth before requests reach the Go process
Enforce a maximum request body size (for example, 1 MB) on endpoints that accept OpenAPI documents to make deep-nesting payloads impractical
Restrict OpenAPI ingestion endpoints to authenticated internal callers until the dependency upgrade is deployed

bash

# Configuration example: upgrade go-openapi/swag in a Go module
go get github.com/go-openapi/swag@v0.27.1
go mod tidy
go build ./...

# Verify the resolved version
go list -m github.com/go-openapi/swag