CVE-2026-73502
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
kin-openapi, a Go project for handling OpenAPI files, from 0.2.0 until 0.144.0 contains a NULL-pointer-dereference denial of service vulnerability in openapi3filter.ValidateRequest when an operation declares a content parameter whose application/json media type has no schema. A single unauthenticated request supplying the parameter value can panic request validation, causing an aborted request with log growth in the common synchronous net/http path or a full process crash in integrations without recovery. This issue is fixed in version 0.144.0.
Risk Assessment
The risk includes service disruptions for applications using kin-openapi, potentially leading to unavailability and financial losses.
Recommendation
It is recommended to upgrade kin-openapi to version 0.144.0 or later and review OpenAPI definitions for content parameters without schemas.
Other vulnerabilities in kin-openapi
See all- CVE-2026-73501Critical
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load() silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without checking credentials. This substitution causes every OpenAPI security requirement to be satisfied for unauthenticated requests when an application relies on ValidationHandler as its enforcement middleware. The no-op callback prevents the fail-closed ErrAuthenticationServiceMissing path from being reached and forwards the request to protected handlers that may require an API key, OAuth token, or another security scheme.
- CVE-2026-77354High
kin-openapi versions 0.124.0 through 0.142.0 have a DoS vulnerability. The sliceMapToSlice function converts attacker-controlled indexes from a deepObject parameter into a dense slice, which can lead to multi-gigabyte heap allocation and cause OOM kill or restart loop.
- CVE-2026-76905High
kin-openapi versions 0.10.0 through 0.141.0 have a DoS vulnerability. The convertParseError function dereferences e.Parameter without checking if it is nil, which can lead to application panic when processing validation errors.
Original NVD description (English source)
kin-openapi is a Go project for handling OpenAPI files. From 0.2.0 until 0.144.0, openapi3filter.ValidateRequest can encounter a NULL-pointer-dereference denial of service when an operation declares a content parameter whose application/json media type has no schema. In openapi3filter/req_resp_decoder.go, the default defaultContentParameterDecoder dereferences mt.Schema.Value without checking whether mt.Schema is nil, even though doc.Validate() accepts the document under OpenAPI 3.0.x and 3.1.x. A single unauthenticated request supplying the parameter value can panic request validation, causing an aborted request with log growth in the common synchronous net/http path or a full process crash in integrations without recovery. This issue is fixed in version 0.144.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS