EUVD-2026-64150
GHSA-mmfr-pmjx-hw9w
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Single unauthenticated HTTP request over network (AV:N, AC:L, PR:N, UI:N) causes goroutine panic with no confidentiality or integrity impact, only high availability loss.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
4DescriptionCVE.org
kin-openapi is a Go project for handling OpenAPI files. From 0.10.0 until 0.141.0, openapi3filter.convertParseError in openapi3filter/validation_error_encoder.go dereferences e.Parameter.In without checking whether e.Parameter is nil. A malformed non-string scalar field in a multipart/form-data request body produces a nested ParseError with a nil RequestError.Parameter, and applications that render the validation error through openapi3filter.ConvertErrors or ValidationErrorEncoder panic. An unauthenticated client can repeatedly send such requests to deny service when the application lacks a recovery boundary. JSON request bodies and applications that do not use these error-rendering helpers are not affected. This issue is fixed in version 0.141.0.
AnalysisAI
Nil pointer dereference in kin-openapi's openapi3filter.ConvertErrors allows any unauthenticated remote client to crash a Go web service with a single HTTP request. Applications using kin-openapi 0.10.0 through 0.140.x that validate multipart/form-data request bodies and render errors through the library-provided ValidationErrorEncoder or ConvertErrors helpers are vulnerable; application/json request bodies are explicitly unaffected by this bug. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Three conditions must simultaneously hold: the target application uses kin-openapi versions 0.10.0 through 0.140.x, the targeted endpoint validates multipart/form-data request bodies against an OpenAPI schema (not application/json), and the application renders validation errors using the library-provided ConvertErrors or ValidationErrorEncoder helpers rather than custom error rendering. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects network accessibility, no authentication requirement, and complete availability impact, which are all accurate for the base vulnerability class. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker sends a single HTTP POST with Content-Type multipart/form-data to any endpoint that validates such bodies against an OpenAPI schema, inserting a string value (e.g., 'notanumber') for a schema-defined integer field. The kin-openapi multipart decoder wraps the parse failure in a nested *ParseError; when the application calls ConvertErrors or ValidationErrorEncoder to render the response, convertParseError dereferences a nil e.Parameter, panicking the handler goroutine. … |
| Remediation | The primary fix is to upgrade kin-openapi to version 0.141.0 or later; the fix commit is https://github.com/getkin/kin-openapi/commit/1d0a337c9b1570fab283be8a04c8af6e43b9a22c and the release is at https://github.com/getkin/kin-openapi/releases/tag/v0.141.0. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all applications and infrastructure components using kin-openapi versions 0.10.0 through 0.140.x, prioritizing production workloads, and determine the business criticality of each affected service. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Kin Openapi
View allUncontrolled heap allocation in kin-openapi versions 0.124.0 through 0.141.x allows any unauthenticated remote client to
Authentication bypass in the kin-openapi Go library (getkin/kin-openapi) before 0.144.0 lets unauthenticated remote atta
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Null Pointer Dereference
View allShare
External POC / Exploit Code
Leaving vuln.today