Heap Smashing Vulnerability in kin-openapi by getkin

CVE-2026-77354

What is CVE-2026-77354?

The kin-openapi project is vulnerable to a heap allocation attack, where an unauthenticated client can send a query that leads to a massive heap allocation. Specifically, when using a deepObject query parameter containing oversized indices, the allocation does not adhere to maximum limits defined by maxItems, leading to the potential for a denial of service. This behavior could crash or force a restart loop on the affected service when the parser attempts to handle excessively large data structures. The issue has been addressed in version 0.142.0.

References