Denial of Service Vulnerability in Kin-OpenAPI Product by Getkin

CVE-2026-73502

What is CVE-2026-73502?

A vulnerability in the kin-openapi project allows for a denial of service due to a NULL-pointer-dereference in the request validation process. Specifically, when an operation defines a content parameter that lacks a schema in the application/json media type, it can trigger a panic during request validation. This occurs in versions from 0.2.0 up to 0.144.0, where the default content parameter decoder does not effectively check for nil schemas prior to dereferencing them. Such an incident can result in either an aborted request with excessive log growth or, in cases where recovery is not implemented, a complete process crash. The issue has been addressed in version 0.144.0.

References