Improper Handling of Highly Compressed Data (Data Amplification) in github.com/getkin/kin-openapi/openapi3filter

Summary When validating a request with a multipart/form-data schema, if the OpenAPI schema allows it, an attacker can upload a crafted ZIP file e.g., a ZIP bomb, causing the server to consume all available system memory. Details The root cause comes from the ZipFileBodyDecoder, which is registere...

DEBIAN-CVE-2025-30153

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.131.0, when validating a request with a multipart/form-data schema, if the OpenAPI schema allows it, an attacker can upload a crafted ZIP file e.g., a ZIP bomb, causing the server to consume all available system memory. The root...

CVE-2025-30153

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.131.0, when validating a request with a multipart/form-data schema, if the OpenAPI schema allows it, an attacker can upload a crafted ZIP file e.g., a ZIP bomb, causing the server to consume all available system memory. The root...

CVE-2025-30153

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.131.0, when validating a request with a multipart/form-data schema, if the OpenAPI schema allows it, an attacker can upload a crafted ZIP file e.g., a ZIP bomb, causing the server to consume all available system memory. The root...

UBUNTU-CVE-2025-30153

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.131.0, when validating a request with a multipart/form-data schema, if the OpenAPI schema allows it, an attacker can upload a crafted ZIP file e.g., a ZIP bomb, causing the server to consume all available system memory. The root...

CVE-2025-30153

CVE-2025-30153 affects kin-openapi (Go) prior to 0.131.0. The issue occurs when validating a request with a multipart/form-data schema: if the OpenAPI schema allows it, an attacker can upload a crafted ZIP file (e.g., a ZIP bomb) that causes the server to exhaust memory. The root cause is the Zip...

CVE-2025-30153 Improper Handling of Highly Compressed Data (Data Amplification) in github.com/getkin/kin-openapi/openapi3filter

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.131.0, when validating a request with a multipart/form-data schema, if the OpenAPI schema allows it, an attacker can upload a crafted ZIP file e.g., a ZIP bomb, causing the server to consume all available system memory. The root...

CVE-2025-30153

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.131.0, when validating a request with a multipart/form-data schema, if the OpenAPI schema allows it, an attacker can upload a crafted ZIP file e.g., a ZIP bomb, causing the server to consume all available system memory. The root...

CVE-2025-30153 Improper Handling of Highly Compressed Data (Data Amplification) in github.com/getkin/kin-openapi/openapi3filter

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.131.0, when validating a request with a multipart/form-data schema, if the OpenAPI schema allows it, an attacker can upload a crafted ZIP file e.g., a ZIP bomb, causing the server to consume all available system memory. The root...

CVE-2025-30153 Improper Handling of Highly Compressed Data (Data Amplification) in github.com/getkin/kin-openapi/openapi3filter

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.131.0, when validating a request with a multipart/form-data schema, if the OpenAPI schema allows it, an attacker can upload a crafted ZIP file e.g., a ZIP bomb, causing the server to consume all available system memory. The root...

CVE-2025-30153

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.131.0, when validating a request with a multipart/form-data schema, if the OpenAPI schema allows it, an attacker can upload a crafted ZIP file e.g., a ZIP bomb, causing the server to consume all available system memory. The root...

Kin-openapi security vulnerability

kin-openapi is a getkin open source implementation of OpenAPI 3.0 for Go parsing, transforming, validating, etc.. A security vulnerability exists in kin-openapi versions prior to 0.131.0, which stems from a potential memory exhaustion when processing multipart/form-data requests...

CVE-2025-30153: Improper Handling of Highly Compressed Data (Data Amplification)

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.131.0, when validating a request with a multipart/form-data schema, if the OpenAPI schema allows it, an attacker can upload a crafted ZIP file e.g., a ZIP bomb, causing the server to consume all available system memory. The root...

PT-2025-11700

Name of the Vulnerable Software and Affected Versions kin-openapi versions prior to 0.131.0 Description The issue arises when validating a request with a multipart/form-data schema. If the OpenAPI schema allows it, an attacker can upload a crafted ZIP file, such as a ZIP bomb, causing the server ...

@dv.net/docs-vitepress-openapi (>=1.0.7, <=1.0.8), @emahuni/directus.distilled-app-internals (>=1.1.2-app-13.7.1, <=13.7.1-1.1.0) +33 more potentially affected by CVE-2025-27597 via vue-i18n (>=11.0.0, <=11.1.1)

vue-i18n NPM version =11.0.0, =1.0.7, =1.1.2-app-13.7.1, =0.0.1, =0.0.1, =0.0.1, =0.2.550, =0.14.0, =0.14.0, =0.14.0, =0.14.0, =0.14.0, =0.15.0 and more Source cves: CVE-2025-27597 Source advisory: MEND:CVE-2025-27597...

API Specifications: Why, When, and How to Enforce Them

APIs facilitate communication between different software applications and power a wide range of everyday digital experiences, from weather apps to streaming services and everything in between. They are also a critical ingredient of AI. However, if not structured and standardized properly, APIs ca...

MAL-2025-1657 Malicious code in okta-sdk-php-openapi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware da144ffdf9eed05ec70b485602e1d3aeae40d312d6fd4eec8956422e2365bd0b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in okta-sdk-php-openapi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware da144ffdf9eed05ec70b485602e1d3aeae40d312d6fd4eec8956422e2365bd0b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

io.quarkus:quarkus-elytron-security (0.12.0), io.quarkus:quarkus-resteasy-jsonb (0.12.0) +4 more potentially affected by CVE-2025-1634 via io.quarkus:quarkus-resteasy (0.12.0)

io.quarkus:quarkus-resteasy MAVEN version 0.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-resteasy and may be impacted: - io.quarkus:quarkus-elytron-security 0.12.0 - io.quarkus:quarkus-resteasy-jsonb 0.12.0 -...

Denial Of Service

GitLab is vulnerable to Denial of Service DoS. The vulnerability is due to the server's failure to safely process crafted OpenAPI files, and attackers can exploit this to consume excessive resources or crash the service, leading to a denial of service...