Swag (< 0.27.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/swag--0.27.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 18 Sep 2026 02:01:32 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgDenial of Service in go-openapi/swag via Stack Overflowhttps://feed.craftedsignal.io/briefs/2026-09-go-openapi-swag-dos/Fri, 18 Sep 2026 02:01:32 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-go-openapi-swag-dos/The go-openapi/swag library is vulnerable to a stack overflow in its jsonutils component, allowing remote unauthenticated attackers to cause a denial-of-service by submitting deeply nested JSON documents.The go-openapi/swag library, specifically the jsonutils component in versions prior to 0.27.1, contains a critical stack overflow vulnerability. The flaw arises from unbounded recursion during the parsing and serialization of ordered JSON structures, which lacks a defined depth limit. By submitting a specially crafted, deeply nested JSON document to any service or application utilizing the library to process OpenAPI specifications, a remote unauthenticated attacker can trigger a fatal stack overflow. This leads to an immediate crash of the host process, effectively terminating all in-flight requests and causing a denial-of-service condition. Because this library is commonly integrated into API gateways, middleware, and documentation generators, the potential impact across microservices architectures is significant.

Impact

Successful exploitation results in a persistent denial-of-service for any service using the vulnerable library. The vulnerability is triggered by a single request, meaning minimal resources are required for an attacker to disrupt service availability. All deployments of applications using go-openapi/swag versions before 0.27.1 are susceptible to this vector.

Recommendation

Prioritized, concrete actions for development and security teams:

  • Upgrade the go-openapi/swag dependency to version 0.27.1 or later immediately to include the required depth limiting in the jsonutils component.
  • Review all internet-facing services that accept OpenAPI or JSON-based configurations and apply input validation to limit JSON nesting depth as a defense-in-depth measure until the library is patched.
  • Implement crash monitoring and automated service restarts in orchestrators (such as Kubernetes) to mitigate the impact of the resulting process termination.
]]>lowadvisory