kin-openapi EUVD-2026-64151

The target service must run kin-openapi between version 0.124.0 and 0.141.x inclusive. At least one HTTP endpoint processed by the kin-openapi validator must declare a query parameter with style: deepObject and a schema containing an array type - this is a documented, intentional library feature and not a misconfiguration. No authentication is required (CVSS PR:N) and no user interaction is needed (CVSS UI:N); a single unauthenticated HTTP GET request is sufficient. Limiting factors: request-body encodings and non-deepObject query parameter styles are explicitly excluded by the advisory and are not affected; services that use kin-openapi but expose no deepObject array parameters cannot be reached via this path. Memory-constrained deployments such as containers with low memory limits or serverless functions will crash faster and may require manual intervention to recover from a restart loop.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H, score 8.7) accurately characterises this as a trivially exploitable, unauthenticated network denial-of-service requiring no special conditions and no user interaction. The availability impact is severe and sustained: a single sub-kilobyte HTTP request can OOM-kill the target process and hold it in a restart loop for as long as the attacker continues sending requests. No EPSS score was provided in the source data, so exploitation base-rate cannot be quantified; however, the zero-authentication, single-packet attack surface means that any internet-exposed endpoint matching the vulnerable parameter pattern warrants high-priority remediation regardless. Active exploitation is not confirmed - the CVE is not listed in CISA KEV as of the input data - but the public advisory includes the complete vulnerable code path and a working example payload, making independent weaponisation straightforward. No confidentiality or integrity impact is present, which appropriately bounds the score relative to code-execution vulnerabilities, but for availability-sensitive or latency-sensitive services the operational risk is equivalent to a critical finding.

An attacker sends a single HTTP GET request - as short as GET /api/endpoint?items[0][50000000]=x HTTP/1.1 - to any endpoint of a service running kin-openapi 0.124.0 through 0.141.x that exposes a deepObject array query parameter. The decoder reads the index 50000000, allocates a 50-million-element slice filled with nil values, then immediately allocates a second identical slice in buildResObj, driving heap consumption to approximately 6.1 GiB; the OS OOM killer terminates the process, and if the service is managed by a supervisor or container orchestrator it enters a restart loop that can be sustained with repeated requests. The vendor advisory contains the complete vulnerable code path and example payload, providing sufficient detail to construct an exploit without additional research.