kin-openapi CVE-2026-76905

Three conditions must simultaneously hold: the target application uses kin-openapi versions 0.10.0 through 0.140.x, the targeted endpoint validates multipart/form-data request bodies against an OpenAPI schema (not application/json), and the application renders validation errors using the library-provided ConvertErrors or ValidationErrorEncoder helpers rather than custom error rendering. Applications that use only JSON request bodies are explicitly not affected, as the JSON decoder does not produce the nested *ParseError-in-*ParseError structure that reaches the vulnerable branch. Applications with a panic recovery middleware (recover() in an HTTP middleware layer) will catch the panic and return a 500 error rather than crashing, which limits but does not eliminate the DoS impact. No authentication, network privilege, or user interaction is required beyond the ability to send an HTTP request to the target endpoint.

The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects network accessibility, no authentication requirement, and complete availability impact, which are all accurate for the base vulnerability class. The real-world risk is narrower than a raw 7.5 suggests: exploitation requires that the target application both accepts multipart/form-data bodies and routes validation errors through ConvertErrors or ValidationErrorEncoder - applications with custom error handling or JSON-only APIs are entirely unaffected. A panic recovery middleware (recover() in HTTP middleware) would prevent a full crash, further limiting blast radius. No EPSS score was provided in the input, so exploitation probability cannot be quantified numerically. No CISA KEV listing exists, and no public exploit code has been independently identified, though the GHSA advisory and reproduction test case provide sufficient detail for trivial exploitation by any attacker who reads the disclosure. For affected configurations the risk is real and high, warranting prompt patching.

An unauthenticated attacker sends a single HTTP POST with Content-Type multipart/form-data to any endpoint that validates such bodies against an OpenAPI schema, inserting a string value (e.g., 'notanumber') for a schema-defined integer field. The kin-openapi multipart decoder wraps the parse failure in a nested *ParseError; when the application calls ConvertErrors or ValidationErrorEncoder to render the response, convertParseError dereferences a nil e.Parameter, panicking the handler goroutine. Without a recovery boundary, repeated requests deny service to all users of the application.