CVE-2026-93450 affects go-openapi/swag, a JSON-handling library used by many Go-based services that work with OpenAPI specs. Versions before 0.27.1 impose no limit on how deeply nested a JSON document can be, so a remote attacker with no credentials can send one crafted payload to crash the process and drop every in-flight request via a stack overflow. Projects depending on this library should update to a patched release.
// source: nvd.nist.gov ↗