EUVD-2026-64151
GHSA-xhj3-7xw9-vr34
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with no authentication or user interaction; sole impact is high availability loss via OOM crash, with scope unchanged to the vulnerable service.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
kin-openapi is a Go project for handling OpenAPI files. From 0.124.0 until 0.142.0, openapi3filter.sliceMapToSlice in openapi3filter/req_resp_decoder.go converts attacker-controlled sparse indexes from a deepObject query parameter into a dense slice by allocating entries from zero through the largest supplied index, after which buildResObj creates another slice of the same length. This allocation occurs before schema validation, so maxItems does not prevent it. An unauthenticated client can send a small query such as param[items][50000000]=x to an endpoint whose deepObject schema contains an array, forcing multi-gigabyte heap allocation and causing an OOM kill or restart loop. Other request-body encodings and styled parameters that do not produce bracketed integer indexes are not affected. This issue is fixed in version 0.142.0.
AnalysisAI
Uncontrolled heap allocation in kin-openapi versions 0.124.0 through 0.141.x allows any unauthenticated remote client to crash a Go API service with a single tiny HTTP request. The sliceMapToSlice function in openapi3filter/req_resp_decoder.go converts attacker-supplied sparse bracket-indexed array values from a deepObject query parameter into a dense slice by allocating one slot for every position from zero to the attacker's chosen index - before schema validation, including maxItems, ever executes. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target service must run kin-openapi between version 0.124.0 and 0.141.x inclusive. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H, score 8.7) accurately characterises this as a trivially exploitable, unauthenticated network denial-of-service requiring no special conditions and no user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker sends a single HTTP GET request - as short as `GET /api/endpoint?items[0][50000000]=x HTTP/1.1` - to any endpoint of a service running kin-openapi 0.124.0 through 0.141.x that exposes a `deepObject` array query parameter. The decoder reads the index 50000000, allocates a 50-million-element slice filled with nil values, then immediately allocates a second identical slice in `buildResObj`, driving heap consumption to approximately 6.1 GiB; the OS OOM killer terminates the process, and if the service is managed by a supervisor or container orchestrator it enters a restart loop that can be sustained with repeated requests. … |
| Remediation | Upgrade to kin-openapi v0.142.0, the vendor-released patch available at https://github.com/getkin/kin-openapi/releases/tag/v0.142.0; the underlying fix is commit 1223a0f215d2cf9beb2d9eb9ea2649d001c21388 (https://github.com/getkin/kin-openapi/commit/1223a0f215d2cf9beb2d9eb9ea2649d001c21388), which restructures the decoder so that schema constraints are enforced before any slice allocation occurs. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all services and applications using kin-openapi versions 0.124.0 through 0.141.x by auditing dependency files (go.mod, vendor directories) and container images in use. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Kin Openapi
View allNil pointer dereference in kin-openapi's openapi3filter.ConvertErrors allows any unauthenticated remote client to crash
Authentication bypass in the kin-openapi Go library (getkin/kin-openapi) before 0.144.0 lets unauthenticated remote atta
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today