Read the docs
TI-2026-62978 Aliases CVE-2026-93450GHSA-j354-7hcm-wg69

go-openapi/swag jsonutils before 0.27.1 Uncontrolled Recursion in Ordered JSON Marshal and Unmarshal

Priority HIGH 77CWE-674Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 1 fixed, 1 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-674.

Summary

go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON parsing and serialization due to unbounded recursion with no depth limit. Remote unauthenticated attackers can submit deeply nested JSON documents to services accepting OpenAPI specifications, causing fatal stack overflow that terminates the process and all in-flight requests.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01318 70th percentileScored 2026-11-07
Fix Partial swag (go-openapi): 0.27.1Red Hat: 20 advisoriesRed Hat: 1 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
go-openapiswagbefore 0.27.10.27.1Patch availableCNA
  • swag Vendorgo-openapi Affected before 0.27.1 Fixed in 0.27.1 Patch available CNA

Remediation

  • Fix · CNA swag (go-openapi) Fixed in 0.27.1

Red Hat 20 advisories

  • RHSA-2026:85266 Released 2026-10-19 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images grafana13.2-13.2.3-0.3.hum1@aarch64, grafana13.2-13.2.3-0.3.hum1@s390x, grafana13.2-13.2.3-0.3.hum1@src +1
  • RHSA-2026:74871 Released 2026-10-02 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images grafana12.4-12.4.12-0.3.hum1@aarch64, grafana12.4-12.4.12-0.3.hum1@src, grafana12.4-12.4.12-0.3.hum1@x86_64
  • RHSA-2026:72750 Released 2026-09-28 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images prometheus3.13-3.13.3-0.2.hum1@aarch64, prometheus3.13-3.13.3-0.2.hum1@src, prometheus3.13-3.13.3-0.2.hum1@x86_64
Show 17 more Red Hat advisories
  • RHSA-2026:72570 Released 2026-09-28 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images loki3.6-3.6.17-0.3.hum1@aarch64, loki3.6-3.6.17-0.3.hum1@src, loki3.6-3.6.17-0.3.hum1@x86_64 +4
  • RHSA-2026:72507 Released 2026-09-28 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images grafana13.2-13.2.1-0.8.hum1@aarch64, grafana13.2-13.2.1-0.8.hum1@src, grafana13.2-13.2.1-0.8.hum1@x86_64
  • RHSA-2026:72498 Released 2026-09-28 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images grafana13.1-13.1.6-0.4.hum1@aarch64, grafana13.1-13.1.6-0.4.hum1@src, grafana13.1-13.1.6-0.4.hum1@x86_64
  • RHSA-2026:72497 Released 2026-09-28 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images grafana12.4-12.4.10-0.9.hum1@aarch64, grafana12.4-12.4.10-0.9.hum1@src, grafana12.4-12.4.10-0.9.hum1@x86_64
  • RHSA-2026:72496 Released 2026-09-28 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images loki3.7-3.7.8-0.3.hum1@aarch64, loki3.7-3.7.8-0.3.hum1@src, loki3.7-3.7.8-0.3.hum1@x86_64 +4
  • RHSA-2026:72493 Released 2026-09-28 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images spire1.15-1.15.3-0.2.hum1@aarch64, spire1.15-1.15.3-0.2.hum1@src, spire1.15-1.15.3-0.2.hum1@x86_64 +6
  • RHSA-2026:72492 Released 2026-09-28 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images trivy-0.74.0-0.4.hum1@aarch64, trivy-0.74.0-0.4.hum1@src, trivy-0.74.0-0.4.hum1@x86_64
  • RHSA-2026:72491 Released 2026-09-28 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images tempo3.0-3.0.3-0.4.hum1@aarch64, tempo3.0-3.0.3-0.4.hum1@src, tempo3.0-3.0.3-0.4.hum1@x86_64
  • RHSA-2026:72490 Released 2026-09-28 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images tempo2.10-2.10.8-0.4.hum1@aarch64, tempo2.10-2.10.8-0.4.hum1@src, tempo2.10-2.10.8-0.4.hum1@x86_64
  • RHSA-2026:72489 Released 2026-09-28 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images spire1.14-1.14.7-0.5.hum1@aarch64, spire1.14-1.14.7-0.5.hum1@src, spire1.14-1.14.7-0.5.hum1@x86_64 +6
  • RHSA-2026:72488 Released 2026-09-28 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images cosign-3.1.3-0.2.hum1@aarch64, cosign-3.1.3-0.2.hum1@src, cosign-3.1.3-0.2.hum1@x86_64
  • RHSA-2026:71906 Released 2026-09-25 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images grafana13.2-13.2.1-0.7.hum1@aarch64, grafana13.2-13.2.1-0.7.hum1@src, grafana13.2-13.2.1-0.7.hum1@x86_64
  • RHSA-2026:68729 Released 2026-09-17 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images helm4-4.3.0-0.2.hum1@aarch64, helm4-4.3.0-0.2.hum1@src, helm4-4.3.0-0.2.hum1@x86_64
  • RHSA-2026:68717 Released 2026-09-17 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images helm3-3.22.0-0.2.hum1@aarch64, helm3-3.22.0-0.2.hum1@src, helm3-3.22.0-0.2.hum1@x86_64
  • RHSA-2026:68591 Released 2026-09-17 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images opentelemetry-collector-k8s-0.161.0-0.1.hum1@aarch64, opentelemetry-collector-k8s-0.161.0-0.1.hum1@src, opentelemetry-collector-k8s-0.161.0-0.1.hum1@x86_64
  • RHSA-2026:68290 Released 2026-09-16 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images opentelemetry-collector-contrib-0.161.0-0.1.hum1@aarch64, opentelemetry-collector-contrib-0.161.0-0.1.hum1@src, opentelemetry-collector-contrib-0.161.0-0.1.hum1@x86_64
  • RHSA-2026:68272 Released 2026-09-16 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images opentelemetry-collector-0.161.0-0.1.hum1@aarch64, opentelemetry-collector-0.161.0-0.1.hum1@src, opentelemetry-collector-0.161.0-0.1.hum1@x86_64

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Hardened ImagesAffectedNo fix planned: Will not fix
Red Hat Hardened ImagesFixed RHSA-2026:68272, RHSA-2026:68290, RHSA-2026:68591, RHSA-2026:68717, RHSA-2026:68729, RHSA-2026:71906, RHSA-2026:72488, RHSA-2026:72489, RHSA-2026:72490, RHSA-2026:72491, RHSA-2026:72492, RHSA-2026:72493, RHSA-2026:72496, RHSA-2026:72497, RHSA-2026:72498, RHSA-2026:72507, RHSA-2026:72570, RHSA-2026:72750, RHSA-2026:74871, RHSA-2026:85266
Not affected: 1 product
  • Red Hat Hardened Images

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-93450
  2. 2026-10-03 Alias added: GHSA-j354-7hcm-wg69
  3. 2026-10-20 Fix available: RHSA-2026:71906 · Red Hat
  4. 2026-10-20 Fix available: RHSA-2026:72488 · Red Hat
  5. 2026-10-20 Fix available: RHSA-2026:72490 · Red Hat
  6. 2026-10-20 Fix available: RHSA-2026:72491 · Red Hat
  7. 2026-10-20 Fix available: RHSA-2026:72492 · Red Hat
  8. 2026-10-20 Fix available: RHSA-2026:72497 · Red Hat
  9. 2026-10-20 Fix available: RHSA-2026:72750 · Red Hat
  10. 2026-10-20 Fix available: RHSA-2026:72498 · Red Hat
  11. 2026-10-20 Fix available: RHSA-2026:68717 · Red Hat
  12. 2026-10-20 Fix available: RHSA-2026:68729 · Red Hat
  13. 2026-10-20 Fix available: RHSA-2026:72507 · Red Hat
  14. 2026-10-20 Fix available: RHSA-2026:68272 · Red Hat
  15. 2026-10-20 Fix available: RHSA-2026:68591 · Red Hat
  16. 2026-10-20 Fix available: RHSA-2026:68290 · Red Hat
  17. 2026-10-20 Fix available: RHSA-2026:74871 · Red Hat
  18. 2026-10-20 Fix available: RHSA-2026:85266 · Red Hat
  19. 2026-10-20 Fix available: RHSA-2026:72489 · Red Hat
  20. 2026-10-20 Fix available: RHSA-2026:72496 · Red Hat
  21. 2026-10-20 Fix available: RHSA-2026:72570 · Red Hat
  22. 2026-10-20 Fix available: RHSA-2026:72493 · Red Hat
  23. 2026-10-20 Fix available: Red Hat Hardened Images · Red Hat
  24. 2026-10-20 CVSS score added · Red Hat

References

Patch 1

Advisory 1

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences