PT-2025-11700 · Unknown · Kin-Openapi
Published
2025-03-19
·
Updated
2026-05-18
·
CVE-2025-30153
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
kin-openapi versions prior to 0.131.0
Description
The issue arises when validating a request with a multipart/form-data schema. If the OpenAPI schema allows it, an attacker can upload a crafted ZIP file, such as a ZIP bomb, causing the server to consume all available system memory. The root cause is attributed to the
ZipFileBodyDecoder, which is registered automatically by the module.Recommendations
For versions prior to 0.131.0, update to version 0.131.0 to resolve the issue. As a temporary workaround, consider disabling the
ZipFileBodyDecoder function until a patch is available. Restrict access to the multipart/form-data schema to minimize the risk of exploitation. Avoid using the ZipFileBodyDecoder in the affected API endpoint until the issue is resolved.Exploit
Fix
DoS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Kin-Openapi