Skip to content
Fencer Vulns
high 7.5

CVE-2025-30153 json

Improper Handling of Highly Compressed Data (Data Amplification) in github.com/getkin/kin-openapi/openapi3filter

published 2025-03-19 19 mo ago modified 2026-09-10 1 mo ago also GHSA-wq9g-9vfc-cfq9 , GO-2025-3533 , EUVD-2025-6729

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 50%
public exploits
0
none known

Summary

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.131.0, when validating a request with a multipart/form-data schema, if the OpenAPI schema allows it, an attacker can upload a crafted ZIP file (e.g., a ZIP bomb), causing the server to consume all available system memory. The root cause comes from the ZipFileBodyDecoder, which is registered automatically by the module (contrary to what the documentation says). This vulnerability is fixed in 0.131.0.

Patch / fix

  • go github.com/getkin/kin-openapi 0.131.0
  • golang-github-getkin-kin-openapi Debian 14 0.135.0-1

debian advisories DEBIAN-CVE-2025-30153

  • grafana SLE Module for Package Hub 15 SP7 12.4.5-150200.3.91.1

suse advisories SUSE-SU-2026:3718-1

  • grafana openSUSE Leap 16.0 11.6.14+security04-bp160.1.1
  • grafana openSUSE Tumbleweed 11.6.14+security01-4.1
  • mcphost openSUSE Tumbleweed 0.34.0-1.1
  • govulncheck-vulndb openSUSE Tumbleweed 0.0.20250327T184518-1.1

opensuse advisories openSUSE-SU-2026:20940-1openSUSE-SU-2026:10922-1openSUSE-SU-2026:10731-1openSUSE-SU-2025:14937-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-30153 updated cvss 7.5

github.com/getkin/kin-openapi/openapi3filter: Improper Handling of Highly Compressed Data (Data Amplification) in github.com/getkin/kin-openapi/openapi3filter

  • Red Hat Edge Manager preview flightctl, rhem/flightctl-worker-rhel9, rhacm2/acm-search-v2-api-rhel9
    affected: workaround, no fix available “Disable any endpoints in your OpenAPI schema that allows multipart/form-data or allows the uploading of a zipfile.”
  • Red Hat multicluster engine for Kubernetes 2.8 multicluster-engine/managedcluster-import-controller-rhel9 1779838779
    fixed: vendor fix “Disable any endpoints in your OpenAPI schema that allows multipart/form-data or allows the uploading of a zipfile.” RHSA-2026:22689
  • Red Hat multicluster engine for Kubernetes 2.8 multicluster-engine/hive-rhel9 1780085997, multicluster-engine/work-rhel9 1779313350, multicluster-engine/discovery-rhel9 1779551818, multicluster-engine/placement-rhel9 1779313357, multicluster-engine/console-mce-rhel9 1779810262, multicluster-engine/must-gather-rhel9 1779551704, +20 more Red Hat Edge Manager preview rhem/flightctl-periodic-rhel9
    not affected: vulnerable code not present
  • Red Hat Enterprise Linux 8 osbuild-composer, osbuild-composer-core, osbuild-composer-worker, osbuild-composer-dnf-json Red Hat Enterprise Linux 9 osbuild-composer, osbuild-composer-core, osbuild-composer-worker, osbuild-composer-dnf-json Red Hat Enterprise Linux 10 osbuild-composer
    not affected: vulnerable code not in execute path

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
partial
Assessed
19 mo ago

Exploit prediction

0.62% chance of exploitation in the next 30 days, higher than 50% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
go github.com/getkin/kin-openapi
<0.131.0
0.131.0

Affected products

  • getkin kin-openapi

Classification

Weakness
  • CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.