Kin Openapi
Monthly
Nil-pointer dereference in kin-openapi 0.136.0 through 0.148.x lets an unauthenticated remote client reliably panic Go applications that run openapi3filter request validation against an OpenAPI 3.1 spec declaring an array schema without an items definition. Three decoder paths are affected: a plain array query parameter, a deepObject query parameter whose object contains an array property, and an application/x-www-form-urlencoded body whose array property appears inside an allOf, anyOf, or oneOf subschema - each passes a nil items schema into urlValuesDecoder.parseArray or buildResObj, which dereferences it. Impact is availability-only (CVSS 7.5, CWE-476), exploitation is conditional on the target application actually exposing such a nil-items array schema on a validated route, and no public exploit code or CISA KEV entry is identified at time of analysis; the vendor fixed the issue in 0.149.0.
Denial of service in kin-openapi before 0.149.0 allows unauthenticated remote attackers to terminate the entire Go process by triggering unbounded recursion during runtime schema validation. When a loaded OpenAPI document contains an allOf, anyOf, or oneOf chain that refers back to an ancestor schema - a circular reference the loader and document validation accept without error - a request or response that reaches that schema causes Schema.visitJSON or openapi3filter.decodeValue to recurse until the goroutine stack is exhausted; the resulting fatal stack overflow cannot be caught with recover and aborts the whole process, including unrelated in-flight requests. The assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5), driven entirely by availability with no confidentiality or integrity impact; the key limiting factor is that a vulnerable circular schema must already exist in the deployed spec, so default non-circular specs are unaffected. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the issue is fixed in version 0.149.0.
An unauthenticated remote request can slip past kin-openapi's openapi3filter authentication middleware and reach a handler that was meant to be protected, when the library's ValidationHandler is used as middleware in front of a gorilla/mux router configured with UseEncodedPath. The library validates the operation it derives from the decoded URL.Path (0.144.0 through 0.146.x), while the downstream mux router, using the raw encoded path, dispatches to a different, protected parameterized route that overlaps the public exact route after decoding - so requests carrying an encoded slash (%2F) can be validated as the public operation and then served by the protected handler without the configured AuthenticationFunc ever running. Reaching the flaw requires a precise deployment stack (kin-openapi >=0.144.0 <0.147.0, ValidationHandler wired as auth middleware, mux with UseEncodedPath, and an overlapping public exact route plus protected parameterized route sharing an HTTP method), which is reflected in the CVSS 7.4 rating with AC:H; no CISA KEV listing, and no public exploit identified at time of analysis, though the upstream fix commit includes a regression test that reproduces the bypass.
Response validation in kin-openapi (openapi3filter.ValidateResponse) panics with a nil pointer dereference when an OpenAPI 3.x document declares a response header using a 'content' media-type object instead of a 'schema' field - the document itself validates successfully, but every response validation for the affected operation dereferences the nil schema and crashes, even when the response omits the declared header entirely. All versions prior to 0.146.0 are affected, and the flaw is unauthenticated and network-reachable (CVSS 4.0 AV:N/PR:N), though the decisive qualifier is AT:P: remote availability impact realistically applies only to applications that ingest untrusted or third-party specifications, while applications using only trusted local specs suffer a self-inflicted crash when the affected operation is exercised. No public exploit code and no confirmed active exploitation were identified at time of analysis; the upstream commit adds a regression test and a nil-schema guard in the decoder. EPSS data was not provided for this CVE.
A nil-pointer panic in kin-openapi's openapi3filter validation path can crash any Go service that embeds versions 0.136.0 through 0.142.x and serves an OpenAPI 3.1 document with an array schema that omits the items keyword. Unauthenticated remote clients (CVSS vector PR:N/UI:N) only need to send a single nonempty application/x-www-form-urlencoded or multipart/form-data request to an affected operation - or trigger a matching response on a surface such as a response header - to deterministically panic ValidateRequest or ValidateResponse, producing denial of service with no confidentiality or integrity impact (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, CVSS 7.5). The risk is real but bounded: only OpenAPI 3.1 specs containing the specific malformed-but-spec-legal array shape are exposed, JSON request bodies use a different decoder, and OpenAPI 3.0 documents are rejected at validation time. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation.
Uncontrolled heap allocation in kin-openapi versions 0.124.0 through 0.141.x allows any unauthenticated remote client to crash a Go API service with a single tiny HTTP request. The `sliceMapToSlice` function in `openapi3filter/req_resp_decoder.go` converts attacker-supplied sparse bracket-indexed array values from a `deepObject` query parameter into a dense slice by allocating one slot for every position from zero to the attacker's chosen index - before schema validation, including `maxItems`, ever executes. A 24-byte request such as `?param[items][50000000]=x` triggers approximately 6.1 GiB of heap allocation across two sequential allocations, causing an OOM kill and sustained service restart loop; no public exploit has been separately released but the vendor advisory GHSA-xhj3-7xw9-vr34 contains the complete vulnerable code path and a working example payload.
Nil pointer dereference in kin-openapi's openapi3filter.ConvertErrors allows any unauthenticated remote client to crash a Go web service with a single HTTP request. Applications using kin-openapi 0.10.0 through 0.140.x that validate multipart/form-data request bodies and render errors through the library-provided ValidationErrorEncoder or ConvertErrors helpers are vulnerable; application/json request bodies are explicitly unaffected by this bug. No public exploit identified at time of analysis, but the published GHSA advisory includes exact code paths and a reproduction test case, making exploitation trivial; the vendor-released fix is available in v0.141.0.
Authentication bypass in the kin-openapi Go library (getkin/kin-openapi) before 0.144.0 lets unauthenticated remote attackers reach protected routes when an application uses openapi3filter.ValidationHandler as its enforcement middleware without explicitly setting an AuthenticationFunc. Because Load() silently substitutes a no-op callback for a nil AuthenticationFunc, every OpenAPI security requirement is treated as satisfied and the fail-closed guard is never reached. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the flaw is fail-open by default, disclosed with source-level detail in GHSA-r277-6w6q-xmqw, and carries a vendor CVSS of 9.1.
A low-severity denial-of-service condition affects the Go library kin-openapi in versions 0.145.0 through 0.146.0 (exclusive). When an application uses openapi3filter.ValidateRequest and its OpenAPI schema defines at least one query parameter with the deepObject serialization style, an unauthenticated remote client can send a request containing a large number of unrelated query keys, causing the urlValuesDecoder.DecodeObject routine to recompile the same parameter-name regular expression once per key and consume CPU and memory proportional to the attacker-controlled key count. The vulnerability scores CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), and no public exploit code was identified at time of analysis; the issue is fixed in release 0.146.0.
Unsupported or non-canonical HTTP methods sent to Go services built on kin-openapi's openapi3filter.ValidationHandler with the legacy router reach a panic in PathItem.GetOperation before authentication runs, letting an unauthenticated remote client repeatedly abort connections and inflate stack-trace logs in all versions prior to 0.145.0. The access vector is network-only with no privileges or user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), but the effect is bounded: Go recovers per-request panics by default, so the worst case is per-connection denial of service and log growth rather than a full process crash, and the panic requires an exactly-matched static path (a path served only by a templated route does not reach the same sink). No public exploit code was identified at time of analysis, and CISA KEV does not list this issue as confirmed actively exploited.
A nil pointer dereference in kin-openapi versions prior to 0.145.0 lets a crafted OpenAPI document panic the loader, denying service to any host application that parses untrusted specs. Trigerring it requires only a self-referential additionalProperties JSON Reference - a schema whose $ref targets its own additionalProperties member - which is dereferenced inside Loader.resolveComponent before document validation runs, so doc.Validate cannot block it (CVSS 3.1: 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, CWE-476). There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); exposure is limited to services that accept attacker-supplied OpenAPI documents, and patched version 0.145.0 is available.
Nil-pointer dereference in kin-openapi 0.136.0 through 0.148.x lets an unauthenticated remote client reliably panic Go applications that run openapi3filter request validation against an OpenAPI 3.1 spec declaring an array schema without an items definition. Three decoder paths are affected: a plain array query parameter, a deepObject query parameter whose object contains an array property, and an application/x-www-form-urlencoded body whose array property appears inside an allOf, anyOf, or oneOf subschema - each passes a nil items schema into urlValuesDecoder.parseArray or buildResObj, which dereferences it. Impact is availability-only (CVSS 7.5, CWE-476), exploitation is conditional on the target application actually exposing such a nil-items array schema on a validated route, and no public exploit code or CISA KEV entry is identified at time of analysis; the vendor fixed the issue in 0.149.0.
Denial of service in kin-openapi before 0.149.0 allows unauthenticated remote attackers to terminate the entire Go process by triggering unbounded recursion during runtime schema validation. When a loaded OpenAPI document contains an allOf, anyOf, or oneOf chain that refers back to an ancestor schema - a circular reference the loader and document validation accept without error - a request or response that reaches that schema causes Schema.visitJSON or openapi3filter.decodeValue to recurse until the goroutine stack is exhausted; the resulting fatal stack overflow cannot be caught with recover and aborts the whole process, including unrelated in-flight requests. The assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5), driven entirely by availability with no confidentiality or integrity impact; the key limiting factor is that a vulnerable circular schema must already exist in the deployed spec, so default non-circular specs are unaffected. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the issue is fixed in version 0.149.0.
An unauthenticated remote request can slip past kin-openapi's openapi3filter authentication middleware and reach a handler that was meant to be protected, when the library's ValidationHandler is used as middleware in front of a gorilla/mux router configured with UseEncodedPath. The library validates the operation it derives from the decoded URL.Path (0.144.0 through 0.146.x), while the downstream mux router, using the raw encoded path, dispatches to a different, protected parameterized route that overlaps the public exact route after decoding - so requests carrying an encoded slash (%2F) can be validated as the public operation and then served by the protected handler without the configured AuthenticationFunc ever running. Reaching the flaw requires a precise deployment stack (kin-openapi >=0.144.0 <0.147.0, ValidationHandler wired as auth middleware, mux with UseEncodedPath, and an overlapping public exact route plus protected parameterized route sharing an HTTP method), which is reflected in the CVSS 7.4 rating with AC:H; no CISA KEV listing, and no public exploit identified at time of analysis, though the upstream fix commit includes a regression test that reproduces the bypass.
Response validation in kin-openapi (openapi3filter.ValidateResponse) panics with a nil pointer dereference when an OpenAPI 3.x document declares a response header using a 'content' media-type object instead of a 'schema' field - the document itself validates successfully, but every response validation for the affected operation dereferences the nil schema and crashes, even when the response omits the declared header entirely. All versions prior to 0.146.0 are affected, and the flaw is unauthenticated and network-reachable (CVSS 4.0 AV:N/PR:N), though the decisive qualifier is AT:P: remote availability impact realistically applies only to applications that ingest untrusted or third-party specifications, while applications using only trusted local specs suffer a self-inflicted crash when the affected operation is exercised. No public exploit code and no confirmed active exploitation were identified at time of analysis; the upstream commit adds a regression test and a nil-schema guard in the decoder. EPSS data was not provided for this CVE.
A nil-pointer panic in kin-openapi's openapi3filter validation path can crash any Go service that embeds versions 0.136.0 through 0.142.x and serves an OpenAPI 3.1 document with an array schema that omits the items keyword. Unauthenticated remote clients (CVSS vector PR:N/UI:N) only need to send a single nonempty application/x-www-form-urlencoded or multipart/form-data request to an affected operation - or trigger a matching response on a surface such as a response header - to deterministically panic ValidateRequest or ValidateResponse, producing denial of service with no confidentiality or integrity impact (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, CVSS 7.5). The risk is real but bounded: only OpenAPI 3.1 specs containing the specific malformed-but-spec-legal array shape are exposed, JSON request bodies use a different decoder, and OpenAPI 3.0 documents are rejected at validation time. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation.
Uncontrolled heap allocation in kin-openapi versions 0.124.0 through 0.141.x allows any unauthenticated remote client to crash a Go API service with a single tiny HTTP request. The `sliceMapToSlice` function in `openapi3filter/req_resp_decoder.go` converts attacker-supplied sparse bracket-indexed array values from a `deepObject` query parameter into a dense slice by allocating one slot for every position from zero to the attacker's chosen index - before schema validation, including `maxItems`, ever executes. A 24-byte request such as `?param[items][50000000]=x` triggers approximately 6.1 GiB of heap allocation across two sequential allocations, causing an OOM kill and sustained service restart loop; no public exploit has been separately released but the vendor advisory GHSA-xhj3-7xw9-vr34 contains the complete vulnerable code path and a working example payload.
Nil pointer dereference in kin-openapi's openapi3filter.ConvertErrors allows any unauthenticated remote client to crash a Go web service with a single HTTP request. Applications using kin-openapi 0.10.0 through 0.140.x that validate multipart/form-data request bodies and render errors through the library-provided ValidationErrorEncoder or ConvertErrors helpers are vulnerable; application/json request bodies are explicitly unaffected by this bug. No public exploit identified at time of analysis, but the published GHSA advisory includes exact code paths and a reproduction test case, making exploitation trivial; the vendor-released fix is available in v0.141.0.
Authentication bypass in the kin-openapi Go library (getkin/kin-openapi) before 0.144.0 lets unauthenticated remote attackers reach protected routes when an application uses openapi3filter.ValidationHandler as its enforcement middleware without explicitly setting an AuthenticationFunc. Because Load() silently substitutes a no-op callback for a nil AuthenticationFunc, every OpenAPI security requirement is treated as satisfied and the fail-closed guard is never reached. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the flaw is fail-open by default, disclosed with source-level detail in GHSA-r277-6w6q-xmqw, and carries a vendor CVSS of 9.1.
A low-severity denial-of-service condition affects the Go library kin-openapi in versions 0.145.0 through 0.146.0 (exclusive). When an application uses openapi3filter.ValidateRequest and its OpenAPI schema defines at least one query parameter with the deepObject serialization style, an unauthenticated remote client can send a request containing a large number of unrelated query keys, causing the urlValuesDecoder.DecodeObject routine to recompile the same parameter-name regular expression once per key and consume CPU and memory proportional to the attacker-controlled key count. The vulnerability scores CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), and no public exploit code was identified at time of analysis; the issue is fixed in release 0.146.0.
Unsupported or non-canonical HTTP methods sent to Go services built on kin-openapi's openapi3filter.ValidationHandler with the legacy router reach a panic in PathItem.GetOperation before authentication runs, letting an unauthenticated remote client repeatedly abort connections and inflate stack-trace logs in all versions prior to 0.145.0. The access vector is network-only with no privileges or user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), but the effect is bounded: Go recovers per-request panics by default, so the worst case is per-connection denial of service and log growth rather than a full process crash, and the panic requires an exactly-matched static path (a path served only by a templated route does not reach the same sink). No public exploit code was identified at time of analysis, and CISA KEV does not list this issue as confirmed actively exploited.
A nil pointer dereference in kin-openapi versions prior to 0.145.0 lets a crafted OpenAPI document panic the loader, denying service to any host application that parses untrusted specs. Trigerring it requires only a self-referential additionalProperties JSON Reference - a schema whose $ref targets its own additionalProperties member - which is dereferenced inside Loader.resolveComponent before document validation runs, so doc.Validate cannot block it (CVSS 3.1: 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, CWE-476). There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); exposure is limited to services that accept attacker-supplied OpenAPI documents, and patched version 0.145.0 is available.