CVE-2025-30153
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSummary
CVE-2025-30153 is a high-severity Data Amplification (CWE-409) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Endpoint Denial of Service (T1499); ranked at the 40th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and SC-5 (Denial-of-service Protection) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-30153 is a vulnerability in the kin-openapi Go library, used for handling OpenAPI files, affecting versions prior to 0.131.0. During validation of a request against a multipart/form-data schema, if the schema allows it, the library's ZipFileBodyDecoder—automatically registered by the module despite documentation stating otherwise—processes a crafted ZIP file, such as a ZIP bomb. This causes the server to consume all available system memory, leading to denial of service. The issue is classified under CWE-409 (Insufficient Resource Pool) with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
An unauthenticated attacker with network access to a vulnerable server can exploit this by sending a specially crafted multipart/form-data request containing a ZIP bomb, requiring low complexity and no user interaction. Successful exploitation results in high-impact availability disruption through complete memory exhaustion on the server, without affecting confidentiality or integrity.
The vulnerability is addressed in kin-openapi version 0.131.0, as detailed in the GitHub security advisory at https://github.com/getkin/kin-openapi/security/advisories/GHSA-wq9g-9vfc-cfq9 and the fixing commit at https://github.com/getkin/kin-openapi/commit/67f0b233ffc01332f7d993f79490fbea5f4455f1. Additional context on the root cause appears in the library's req_resp_decoder.go source code, and documentation at https://github.com/getkin/kin-openapi?tab=readme-ov-file#custom-content-type-for-body-of-http-requestresponse notes handling of custom content types for request/response bodies.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-6729
Vulnerability Data
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.131.0, when validating a request with a multipart/form-data schema, if the OpenAPI schema allows it, an attacker can upload a crafted ZIP file (e.g., a ZIP bomb), causing the…
more
server to consume all available system memory. The root cause comes from the ZipFileBodyDecoder, which is registered automatically by the module (contrary to what the documentation says). This vulnerability is fixed in 0.131.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Input validation can reject or limit decompression of data whose expansion ratio exceeds safe thresholds.
DoS protection limits the resource-exhaustion impact when a decompression bomb is processed.
Resource allocation controls bound memory/CPU consumption that a data-amplification attack would otherwise exhaust.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure-development practices include input-validation and resource-limit checks that prevent improper handling of compressed data.
Runtime monitoring of compute resources can detect exhaustion caused by decompression bombs.
Capacity planning and monitoring directly limits the availability impact of data-amplification attacks.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can uncover decompression-bomb vulnerabilities before release.
Redundancy helps availability but does not address the root cause of the weakness.
Monitoring can detect anomalous resource usage but does not prevent the weakness.
Secure development lifecycle includes input validation and resource-limit checks that mitigate data-amplification attacks.
Application security requirements can mandate limits on decompression size and ratio.
Secure architecture principles encourage defensive design against resource-exhaustion threats.