Improper Handling of Highly Compressed Data (Data Amplification) in github.com/getkin/kin-openapi/openapi3filter

Not analysed yet

We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.

Severity and exploitation

• CISA KEV Not listed.
• EPSS 0.0062, the 49th percentile, on 6 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

1. 31 Oct 2026, 14:15 UTC First seen by agentprime
2. 31 Oct 2026, 14:15 UTC Confirmed by OSV

Sources

• GitHub Advisory Database: GHSA-wq9g-9vfc-cfq9
• OSV: GHSA-wq9g-9vfc-cfq9
• github.com/getkin/kin-openapi/security/advisories/GHSA-wq9g-9vfc-cfq9
• nvd.nist.gov/vuln/detail/CVE-2025-30153
• github.com/getkin/kin-openapi/pull/1059
• github.com/getkin/kin-openapi/commit/67f0b233ffc01332f7d993f79490fbea5f4455f1
• github.com/getkin/kin-openapi
• github.com/getkin/kin-openapi/blob/6da871e0e170b7637eb568c265c08bc2b5d6e7a3/openapi3filter/req_resp_decoder.go#L1275
• github.com/getkin/kin-openapi/blob/6da871e0e170b7637eb568c265c08bc2b5d6e7a3/openapi3filter/req_resp_decoder.go#L1523
• github.com/getkin/kin-openapi?tab=readme-ov-file#custom-content-type-for-body-of-http-requestresponse

Facts on this page come from the GitHub Advisory Database (CC-BY 4.0), OSV and the other sources listed, as published. We don’t reproduce full advisory descriptions, which can contain exploit code.