Executive brief
The kin-openapi library's error-rendering component crashes when processing malformed multipart form submissions with invalid scalar values. Any unauthenticated user can trigger a denial-of-service by sending a single crafted HTTP request to an endpoint that accepts multipart form data and uses the library's standard error handler. The crash aborts the request handler, and repeated attacks prevent the service from handling legitimate traffic.
Technical details
The vulnerability exists in the convertParseError function at openapi3filter/validation_error_encoder.go:119-120, where the code dereferences e.Parameter.In without first checking if e.Parameter is nil. This occurs only when processing multipart/form-data bodies because the multipart decoder wraps ParseError objects inside other ParseError objects (nested), causing a type assertion to succeed and execution to reach the unsafe dereference. In contrast, JSON parsing paths either fail the type assertion (JSON syntax errors) or route to a different handler (schema violations). The precondition for exploitation requires an endpoint accepting multipart/form-data with at least one non-string scalar property, and that the application use the library's ValidationErrorEncoder or ConvertErrors helper to format validation responses. No authentication or special privileges are required. The recommended fix is a one-line nil guard: change the condition to include `e.Parameter != nil` before accessing `e.Parameter.In`.
Affected products
- getkin kin-openapi 0.10.0 through 0.140.0
Timeline
- 2026-07-10: disclosed
- 2026-08-21: patched: Version 0.141.0 released with fix
- 2026-08-21: advisory: GitHub Advisory Database published
References
- https://api.github.com/users/matiasinsaurralde
- https://github.com/matiasinsaurralde
- https://api.github.com/users/matiasinsaurralde/gists%7B/gist_id%7D
- https://api.github.com/users/matiasinsaurralde/repos
- https://avatars.githubusercontent.com/u/20110?v=4
- https://api.github.com/users/matiasinsaurralde/events%7B/privacy%7D