---
id: CVE-2026-93450
title: >-
  go-openapi/swag jsonutils before 0.27.1 contains a stack overflow
  vulnerability in ordered JSON parsing and serialization due to unbounded
  recursion with no depth limit
summary: >-
  go-openapi/swag jsonutils before 0.27.1 contains a stack overflow
  vulnerability in ordered JSON parsing and serialization due to unbounded
  recursion with no depth limit. Remote unauthenticated attackers can submit
  deeply nested JSON docu…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-674
vendor: go-openapi
product: swag
affected:
  - swag < 0.27.1
published: '2026-09-18'
updated: '2026-09-22'
sourceUpdated: '2026-09-22T20:25:55.870'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-93450'
references:
  - url: 'https://github.com/go-openapi/swag'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/go-openapi/swag/blob/v0.27.0/jsonutils/adapters/stdlib/json/adapter.go#L68
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/go-openapi/swag/blob/v0.27.0/jsonutils/adapters/stdlib/json/ordered_map.go#L214
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/go-openapi/swag/commit/0c24346ced59a25811e8694a915e7131d25ccb0e
    label: disclosure@vulncheck.com
  - url: 'https://github.com/go-openapi/swag/security/advisories/GHSA-xh24-9qpg-8w28'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/go-openapi-swag-jsonutils-before-0.27.1-uncontrolled-recursion-in-ordered-json-marshal-and-unmarshal
    label: disclosure@vulncheck.com
  - url: 'https://github.com/go-openapi/swag/security/advisories/GHSA-xh24-9qpg-8w28'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00917
epssPercentile: 0.58479
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-18T12:58:19.479020Z'
ingestedAt: '2026-09-17T23:31:20.694Z'
---

## Overview

go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON parsing and serialization due to unbounded recursion with no depth limit. Remote unauthenticated attackers can submit deeply nested JSON documents to services accepting OpenAPI specifications, causing fatal stack overflow that terminates the process and all in-flight requests.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.