CVE-2026-77354
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
kin-openapi versions 0.124.0 through 0.142.0 have a DoS vulnerability. The sliceMapToSlice function converts attacker-controlled indexes from a deepObject parameter into a dense slice, which can lead to multi-gigabyte heap allocation and cause OOM kill or restart loop.
Risk Assessment
An unauthenticated attacker can send a small query that causes memory exhaustion and service unavailability, leading to downtime.
Recommendation
Update kin-openapi to version 0.142.0 or later, which includes the fix.
Other vulnerabilities in kin-openapi
See all- CVE-2026-73501Critical
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load() silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without checking credentials. This substitution causes every OpenAPI security requirement to be satisfied for unauthenticated requests when an application relies on ValidationHandler as its enforcement middleware. The no-op callback prevents the fail-closed ErrAuthenticationServiceMissing path from being reached and forwards the request to protected handlers that may require an API key, OAuth token, or another security scheme.
- CVE-2026-76905High
kin-openapi versions 0.10.0 through 0.141.0 have a DoS vulnerability. The convertParseError function dereferences e.Parameter without checking if it is nil, which can lead to application panic when processing validation errors.
- CVE-2026-73502Medium
kin-openapi, a Go project for handling OpenAPI files, from 0.2.0 until 0.144.0 contains a NULL-pointer-dereference denial of service vulnerability in openapi3filter.ValidateRequest when an operation declares a content parameter whose application/json media type has no schema. A single unauthenticated request supplying the parameter value can panic request validation, causing an aborted request with log growth in the common synchronous net/http path or a full process crash in integrations without recovery. This issue is fixed in version 0.144.0.
Original NVD description (English source)
kin-openapi is a Go project for handling OpenAPI files. From 0.124.0 until 0.142.0, openapi3filter.sliceMapToSlice in openapi3filter/req_resp_decoder.go converts attacker-controlled sparse indexes from a deepObject query parameter into a dense slice by allocating entries from zero through the largest supplied index, after which buildResObj creates another slice of the same length. This allocation occurs before schema validation, so maxItems does not prevent it. An unauthenticated client can send a small query such as param[items][50000000]=x to an endpoint whose deepObject schema contains an array, forcing multi-gigabyte heap allocation and causing an OOM kill or restart loop. Other request-body encodings and styled parameters that do not produce bracketed integer indexes are not affected. This issue is fixed in version 0.142.0.