BDSA-2026-33757
BDSA
High
· CVSS 7.7
False Positivego-openapi/swag: Stack Overflow via Deeply Nested JSON
This advisory does not affect KrakenD
The affected code is not reachable remotely. KrakenD only uses it in the
krakend openapi command line tools (import, export and serve), which process
an OpenAPI specification or KrakenD configuration file supplied by the operator. It is
never used to handle client requests while the gateway runs (krakend run). No action
is required beyond not running the openapi tools on untrusted specification files.No CVE identifier has been assigned to this vulnerability, so KrakenD tracks it by its BDSA identifier.
Component
go-openapi/swag (jsonutils)
Disclosed
Nov 4, 2026
CVSS Score
7.7
Description
The JSON utilities in
go-openapi/swag (swag/jsonutils) parse and serialize JSON
recursively with no limit on nesting depth. A deeply nested JSON document can exhaust
the goroutine stack, and Go treats a stack overflow as a fatal error that crashes the
whole process. The upstream fix adds a nesting depth limit, first released in
swag/jsonutils v0.27.3.