CVE-2026-76905
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
kin-openapi versions 0.10.0 through 0.141.0 have a DoS vulnerability. The convertParseError function dereferences e.Parameter without checking if it is nil, which can lead to application panic when processing validation errors.
Risk Assessment
An unauthenticated attacker can repeatedly send malicious requests, causing application crashes and service unavailability.
Recommendation
Update kin-openapi to version 0.141.0 or later, which includes the fix.
Other vulnerabilities in kin-openapi
See all- CVE-2026-73501Critical
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load() silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without checking credentials. This substitution causes every OpenAPI security requirement to be satisfied for unauthenticated requests when an application relies on ValidationHandler as its enforcement middleware. The no-op callback prevents the fail-closed ErrAuthenticationServiceMissing path from being reached and forwards the request to protected handlers that may require an API key, OAuth token, or another security scheme.
- CVE-2026-77354High
kin-openapi versions 0.124.0 through 0.142.0 have a DoS vulnerability. The sliceMapToSlice function converts attacker-controlled indexes from a deepObject parameter into a dense slice, which can lead to multi-gigabyte heap allocation and cause OOM kill or restart loop.
- CVE-2026-73502Medium
kin-openapi, a Go project for handling OpenAPI files, from 0.2.0 until 0.144.0 contains a NULL-pointer-dereference denial of service vulnerability in openapi3filter.ValidateRequest when an operation declares a content parameter whose application/json media type has no schema. A single unauthenticated request supplying the parameter value can panic request validation, causing an aborted request with log growth in the common synchronous net/http path or a full process crash in integrations without recovery. This issue is fixed in version 0.144.0.
Original NVD description (English source)
kin-openapi is a Go project for handling OpenAPI files. From 0.10.0 until 0.141.0, openapi3filter.convertParseError in openapi3filter/validation_error_encoder.go dereferences e.Parameter.In without checking whether e.Parameter is nil. A malformed non-string scalar field in a multipart/form-data request body produces a nested ParseError with a nil RequestError.Parameter, and applications that render the validation error through openapi3filter.ConvertErrors or ValidationErrorEncoder panic. An unauthenticated client can repeatedly send such requests to deny service when the application lacks a recovery boundary. JSON request bodies and applications that do not use these error-rendering helpers are not affected. This issue is fixed in version 0.141.0.