Kin Openapi
Monthly
Uncontrolled heap allocation in kin-openapi versions 0.124.0 through 0.141.x allows any unauthenticated remote client to crash a Go API service with a single tiny HTTP request. The `sliceMapToSlice` function in `openapi3filter/req_resp_decoder.go` converts attacker-supplied sparse bracket-indexed array values from a `deepObject` query parameter into a dense slice by allocating one slot for every position from zero to the attacker's chosen index - before schema validation, including `maxItems`, ever executes. A 24-byte request such as `?param[items][50000000]=x` triggers approximately 6.1 GiB of heap allocation across two sequential allocations, causing an OOM kill and sustained service restart loop; no public exploit has been separately released but the vendor advisory GHSA-xhj3-7xw9-vr34 contains the complete vulnerable code path and a working example payload.
Nil pointer dereference in kin-openapi's openapi3filter.ConvertErrors allows any unauthenticated remote client to crash a Go web service with a single HTTP request. Applications using kin-openapi 0.10.0 through 0.140.x that validate multipart/form-data request bodies and render errors through the library-provided ValidationErrorEncoder or ConvertErrors helpers are vulnerable; application/json request bodies are explicitly unaffected by this bug. No public exploit identified at time of analysis, but the published GHSA advisory includes exact code paths and a reproduction test case, making exploitation trivial; the vendor-released fix is available in v0.141.0.
Authentication bypass in the kin-openapi Go library (getkin/kin-openapi) before 0.144.0 lets unauthenticated remote attackers reach protected routes when an application uses openapi3filter.ValidationHandler as its enforcement middleware without explicitly setting an AuthenticationFunc. Because Load() silently substitutes a no-op callback for a nil AuthenticationFunc, every OpenAPI security requirement is treated as satisfied and the fail-closed guard is never reached. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the flaw is fail-open by default, disclosed with source-level detail in GHSA-r277-6w6q-xmqw, and carries a vendor CVSS of 9.1.
Uncontrolled heap allocation in kin-openapi versions 0.124.0 through 0.141.x allows any unauthenticated remote client to crash a Go API service with a single tiny HTTP request. The `sliceMapToSlice` function in `openapi3filter/req_resp_decoder.go` converts attacker-supplied sparse bracket-indexed array values from a `deepObject` query parameter into a dense slice by allocating one slot for every position from zero to the attacker's chosen index - before schema validation, including `maxItems`, ever executes. A 24-byte request such as `?param[items][50000000]=x` triggers approximately 6.1 GiB of heap allocation across two sequential allocations, causing an OOM kill and sustained service restart loop; no public exploit has been separately released but the vendor advisory GHSA-xhj3-7xw9-vr34 contains the complete vulnerable code path and a working example payload.
Nil pointer dereference in kin-openapi's openapi3filter.ConvertErrors allows any unauthenticated remote client to crash a Go web service with a single HTTP request. Applications using kin-openapi 0.10.0 through 0.140.x that validate multipart/form-data request bodies and render errors through the library-provided ValidationErrorEncoder or ConvertErrors helpers are vulnerable; application/json request bodies are explicitly unaffected by this bug. No public exploit identified at time of analysis, but the published GHSA advisory includes exact code paths and a reproduction test case, making exploitation trivial; the vendor-released fix is available in v0.141.0.
Authentication bypass in the kin-openapi Go library (getkin/kin-openapi) before 0.144.0 lets unauthenticated remote attackers reach protected routes when an application uses openapi3filter.ValidationHandler as its enforcement middleware without explicitly setting an AuthenticationFunc. Because Load() silently substitutes a no-op callback for a nil AuthenticationFunc, every OpenAPI security requirement is treated as satisfied and the fail-closed guard is never reached. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the flaw is fail-open by default, disclosed with source-level detail in GHSA-r277-6w6q-xmqw, and carries a vendor CVSS of 9.1.