CVE-2025-30153

What it actually does

The ZipFileBodyDecoder registered for multipart/form-data schemas decompresses attacker-supplied ZIP archives without size or recursion limits, allowing a ZIP bomb to allocate unbounded memory until the process is killed.

Why it matters to the business

Public-facing services built on affected Debian packages can be rendered unavailable by a single unauthenticated request, causing outages and potential loss of service for dependent applications.

How an attack unfolds

An attacker crafts a small ZIP that expands to gigabytes, posts it inside a multipart/form-data body to any endpoint whose OpenAPI schema permits file uploads, and the automatic decoder exhausts RAM before validation completes.

How to fix it

Upgrade kin-openapi to 0.131.0 or later; on Debian 13 install linux package version 6.12.5-1 or newer. Disable or replace the ZipFileBodyDecoder if immediate patching is not possible.

How to confirm the fix worked

Confirm the running binary or library reports version 0.131.0+, re-test the affected endpoint with a small ZIP payload and verify memory usage remains bounded, and review OpenAPI schemas to ensure file bodies are no longer auto-decoded.

Typical attack path

1. Identify an endpoint accepting multipart/form-data whose schema permits file bodies
2. Generate or obtain a ZIP bomb payload
3. Send the payload in a single HTTP POST request
4. Observe server memory exhaustion and service termination

How to detect it

Review web-server access logs for POST requests containing multipart/form-data with archive content-types, correlate with sudden memory or OOM-killer events in system logs, and inspect Go process core dumps or heap profiles for large inflated ZIP structures.

What your security team should do

• Apply the Debian 6.12.5-1 update or kin-openapi 0.131.0 immediately on all internet-facing instances
• Add rate-limiting and request-size limits at the reverse proxy or WAF layer
• Audit all OpenAPI schemas for unintended file-upload parameters and remove ZipFileBodyDecoder registration
• Monitor memory and process health metrics for sudden spikes on API servers