OpenAPI File Handling Vulnerability in kin-openapi by Getkin

CVE-2025-30153

What is CVE-2025-30153?

The kin-openapi library, a Go project used for managing OpenAPI files, has a significant vulnerability that allows attackers to exploit multipart/form-data schema validation. An attacker could upload a specially crafted ZIP file, such as a ZIP bomb, which could lead to excessive memory consumption on the server. This issue arises from the automatic registration of the ZipFileBodyDecoder, contrary to the documentation, leaving systems vulnerable prior to version 0.131.0. It is crucial for users of kin-openapi to upgrade to the latest version to mitigate this risk.

References