CVE-2025-30153
CVSS 3.1 Score 7.5 of 10 (high)
Details
Published Mar 19, 2025
CWE ID 409
Summary
CVE-2025-30153 is a vulnerability affecting the kin-openapi Go project, which handles OpenAPI files. Before version 0.131.0, the software failed to properly validate multipart/form-data schemas in OpenAPI files. As a result, an attacker could upload a specially crafted ZIP file, potentially causing the server to exhaust all available system memory due to the automatic registration of the ZipFileBodyDecoder in the kin-openapi module. This issue, which goes against the documentation's claims, has been resolved in version 0.131.0.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.