EUVD-2026-61142
GHSA-jpcw-4wr7-c3vq
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Network-reachable with no auth or interaction required; impact is availability only, scored Low because standard net/http recovers from panics per-connection in common deployments.
Primary rating from Vendor (github).
CVSS VectorVendor: github
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Lifecycle Timeline
2DescriptionCVE.org
kin-openapi is a Go project for handling OpenAPI files. From 0.2.0 until 0.144.0, openapi3filter.ValidateRequest can encounter a NULL-pointer-dereference denial of service when an operation declares a content parameter whose application/json media type has no schema. In openapi3filter/req_resp_decoder.go, the default defaultContentParameterDecoder dereferences mt.Schema.Value without checking whether mt.Schema is nil, even though doc.Validate() accepts the document under OpenAPI 3.0.x and 3.1.x. A single unauthenticated request supplying the parameter value can panic request validation, causing an aborted request with log growth in the common synchronous net/http path or a full process crash in integrations without recovery. This issue is fixed in version 0.144.0.
AnalysisAI
NULL-pointer dereference in kin-openapi's request validation pipeline (versions 0.2.0 through 0.143.0) enables any unauthenticated remote client to crash request validation with a single crafted HTTP request. The defect resides in defaultContentParameterDecoder within openapi3filter/req_resp_decoder.go, where mt.Schema.Value is dereferenced without a nil guard when a content parameter's application/json media type declares no schema - a construct that is explicitly valid under both OpenAPI 3.0.x and 3.1.x, meaning doc.Validate() will not surface the issue at startup. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two conditions must both be satisfied: first, the application must use kin-openapi v0.2.0 through v0.143.0 to perform HTTP request validation via openapi3filter.ValidateRequest; second, the deployed OpenAPI specification must define at least one operation parameter using the 'content' style where the application/json media type object contains no 'schema' field - a configuration that passes doc.Validate() without error and is valid under both OpenAPI 3.0.x and 3.1.x. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) accurately captures the key risk signals: no authentication is required, no user interaction is needed, and no elevated network position is necessary, making the attack trivially automatable against any reachable endpoint. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade kin-openapi to v0.144.0, the vendor-released patched version, available at https://github.com/getkin/kin-openapi/releases/tag/v0.144.0. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Null Pointer Dereference
View allShare
External POC / Exploit Code
Leaving vuln.today