Vulnerability in kin-openapi for Go Project Affects Request Handling
CVE-2026-76905
What is CVE-2026-76905?
The kin-openapi project experiences an improper input validation vulnerability due to mishandling of parameter dereferencing in its openapi3filter. Specifically, when processing multipart/form-data requests, a malformed non-string scalar field can lead to a nested ParseError with a nil RequestError.Parameter. This situation may trigger a panic in applications utilizing openapi3filter.ConvertErrors or ValidationErrorEncoder when the validation error is rendered. Unauthenticated clients can exploit this flaw by repeatedly sending such requests, potentially causing a denial of service in applications that do not incorporate a recovery boundary. Versions prior to 0.141.0 are affected, while the issue has been addressed in subsequent updates.
Affected Version(s)
kin-openapi >= 0.10.0, < 0.141.0