CVE catalog

CVE-2025-30153

golang-github-getkin-kin-openapi: CVE-2025-30153

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.62% · Oct 25, 2026

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.131.0, when validating a request with a multipart/form-data schema, if the OpenAPI schema allows it, an attacker can upload a crafted ZIP file (e.g., a ZIP bomb), causing the server to consume all available system memory. The root cause comes from the ZipFileBodyDecoder, which is registered automatically by the module (contrary to what the documentation says). This vulnerability is fixed in 0.131.0.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangolang-github-getkin-kin-openapisid0.135.0-1fixed
Debiangolang-github-getkin-kin-openapiforky0.135.0-1fixed
Debiangolang-github-getkin-kin-openapitrixie0.124.0-1vulnerable
Debiangolang-github-getkin-kin-openapibookworm0.110.0-1vulnerable
Ubuntugolang-github-getkin-kin-openapi22.040.32.0-2vulnerable
Ubuntugolang-github-getkin-kin-openapi22.040.80.0-1vulnerable
Ubuntugolang-github-getkin-kin-openapi22.040.85.0-1vulnerable
Ubuntugolang-github-getkin-kin-openapi24.040.117.0-1vulnerable
Ubuntugolang-github-getkin-kin-openapi24.040.120.0-1vulnerable
Ubuntugolang-github-getkin-kin-openapi24.040.122.0-3vulnerable
Ubuntugolang-github-getkin-kin-openapi24.040.123.0-1vulnerable
Ubuntugolang-github-getkin-kin-openapi26.040.124.0-1vulnerable
Opensusegrafanaleap 16.011.6.14+security04-bp160.1.1fixed
Opensusegrafanatumbleweed11.6.14+security01-4.1fixed
Opensusemcphosttumbleweed0.34.0-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangolang-github-getkin-kin-openapisourcesid0.135.0-1not yet assignedNot reportedNot reported
Debiangolang-github-getkin-kin-openapisourceforky0.135.0-1not yet assignedNot reportedNot reported
Debiangolang-github-getkin-kin-openapisourcetrixie(unfixed)not yet assignedNot reportedNot reported
Debiangolang-github-getkin-kin-openapisourcebookworm(unfixed)not yet assignedNot reportedNot reported
Opensusegrafanarpmleap 16.011.6.14+security04-bp160.1.1Not reportedOPENSUSE-SU-2026:20940-1Not reported
Opensusegrafanarpmtumbleweed11.6.14+security01-4.1Not reportedOPENSUSE-SU-2026:10922-1Not reported
Opensusemcphostrpmtumbleweed0.34.0-1.1Not reportedOPENSUSE-SU-2026:10731-1Not reported

Notes

[trixie] golang-github-getkin-kin-openapi: Minor issue [bookworm] golang-github-getkin-kin-openapi: Minor issue; out of LTS support

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [golang-github-getkin-kin-openapi-dev]Affected

    Source package: [golang-github-getkin-kin-openapi]

    Details (2)

    • 0.110.0-1 · all · bookworm

      Affected

      dsa · golang-github-getkin-kin-openapi · debian · bookworm; dsa · golang-github-getkin-kin-openapi · debian · 12

    • 0.110.0-1 · all · bookworm

      Affected

      dsa · golang-github-getkin-kin-openapi · debian · bookworm; dsa · golang-github-getkin-kin-openapi · debian · 12

[Debian 13 (Trixie)]

[openSUSE Tumbleweed]

  • [mcphost-bash-completion]Unknown

    Source package: [mcphost]

    Details (1)

    • 0.34.0-9.2 · noarch · tumbleweed

      Unknown · Fixed: 0.34.0-1.1

      Version impact unknown

      dsa · mcphost · opensuse · tumbleweed

  • [mcphost-fish-completion]Unknown

    Source package: [mcphost]

    Details (1)

    • 0.34.0-9.2 · noarch · tumbleweed

      Unknown · Fixed: 0.34.0-1.1

      Version impact unknown

      dsa · mcphost · opensuse · tumbleweed

  • [mcphost-zsh-completion]Unknown

    Source package: [mcphost]

    Details (1)

    • 0.34.0-9.2 · noarch · tumbleweed

      Unknown · Fixed: 0.34.0-1.1

      Version impact unknown

      dsa · mcphost · opensuse · tumbleweed

  • [grafana]Fixed

    Source package: [grafana]

    Details (1)

    • 12.4.5-4.1 · x86_64 · tumbleweed

      Fixed · Fixed: 11.6.14+security01-4.1

      dsa · grafana · opensuse · tumbleweed

  • [mcphost]Fixed

    Source package: [mcphost]

    Details (1)

    • 0.34.0-9.2 · x86_64 · tumbleweed

      Fixed · Fixed: 0.34.0-1.1

      dsa · mcphost · opensuse · tumbleweed

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]