Security Bulletin: Automation Assets in IBM Integration are vulnerable to multiple vulnerabilities in github.com/go-openapi/spec

Summary Automation Assets in IBM Integration are vulnerable to multiple vulnerabilities in github.com/go-openapi/spec. The vulnerabilities have been addressed. Vulnerability Details ID:WS-2026-0043 DESCRIPTION: Denial of service via exponential $ref expansion in ExpandSpec/ExpandSchema in...

Security Bulletin: Multiple vulnerabilities in IBM Aspera HTTP Gateway

Summary Multiple vulnerabilities were addressed in IBM Aspera HTTP Gateway version 2.3.5 Vulnerability Details ID:WS-2026-0043 DESCRIPTION: Denial of service via exponential $ref expansion in ExpandSpec/ExpandSchema in github.com/go-openapi/spec. The expander inlines every $ref without memoizatio...

WS-2026-0045

Arbitrary local file read via file:// $ref in github.com/go-openapi/spec. The default document loader used to resolve and expand $ref pointers is not sandboxed: a $ref such as file:///etc/passwd or a relative ../../secret.json is read straight off disk via os.ReadFile, so a specification from an...

WS-2026-0044

Denial of service and SSRF via unbounded http.Get in Ref.IsValidURI in github.com/go-openapi/spec. IsValidURI resolved an absolute-URL $ref by issuing http.Get on http.DefaultClient, which has no timeout and no cancellation, so an attacker-controlled URL that never responds blocks indefinitely an...

WS-2026-0046

Server-side request forgery via $ref HTTP resolution in github.com/go-openapi/spec. The default document loader fetches any URL found in a $ref field with no restriction, so expanding a specification from an untrusted source can reach internal cloud metadata endpoints, private network addresses a...