CVE-2026-77354: kin-openapi uncontrolled resource consumption in deepObject query parameter decoding

CVE-2026-77354 · Severity: high · CVSS 4 · Published 2026-08-21

kin-openapi is a Go library used to validate HTTP requests against OpenAPI specifications. An attacker can send a single small HTTP request (as few as 24 bytes) to force a server using this library to allocate multiple gigabytes of memory, causing an out-of-memory crash and service restart loop. This happens when the OpenAPI spec declares a query parameter with deepObject-style encoding and an array schema—a normal, documented pattern.

Technologies: Getkin Kin-Openapi, github.com/getkin/kin-openapi (Go). Vendors: Getkin, Go.

Quick answers

Is CVE-2026-77354 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-77354 being exploited in the wild.
How severe is CVE-2026-77354?
High severity, with a CVSS score of 4, published 21 August 2026.
Which products and versions are affected?
Getkin Kin-Openapi >=0.124.0, <0.142.0; github.com/getkin/kin-openapi (Go) >= 0.124.0, < 0.142.0, SEMVER:introduced=0.124.0,fixed=0.142.0.
Is there a fix for CVE-2026-77354?
Yes. github.com/getkin/kin-openapi (Go): upgrade to 0.142.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-77354 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-77354?
Check whether you run Getkin Kin-Openapi or github.com/getkin/kin-openapi (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/getkin/kin-openapi (Go): upgrade to 0.142.0 or later
    go get github.com/getkin/kin-openapi@v0.142.0

Technical details

The vulnerability is a CWE-789 / CWE-400 uncontrolled resource consumption flaw in the sliceMapToSlice and buildResObj functions in req_resp_decoder.go. When decoding deepObject-style query parameters (e.g., ?param[items][0]=a&param[items][1]=b), the decoder reconstructs arrays from a sparse map keyed by string indices. It allocates one slot for every position from 0 up to the largest attacker-supplied index N, creating an array of size N+1 without bounds checking. A request with ?param[items][50000000]=x (24 bytes) produces approximately 6.1 GiB of heap allocation. The attack requires only an unauthenticated network request; no authentication or special preconditions are needed. The target spec must declare a query parameter with in: query, style: deepObject, and a schema containing an array—a standard OpenAPI pattern. Critically, schema validation (including maxItems constraints) runs strictly after decoding completes, so declared limits do not prevent the allocation. The vulnerability was introduced in v0.124.0 (commit 78bb273, March 2024) and affects all versions through v0.141.0. A patch is available in v0.142.0.

Affected products

  • getkin kin-openapi >=0.124.0, <0.142.0

Identifiers

  • CVE-2026-77354
  • GHSA-xhj3-7xw9-vr34
  • GO-2026-6275

Timeline

  • 2026-07-11: disclosed: Published in GitHub Advisory Database
  • 2026: patched: Fix released in v0.142.0
  • 2026-08-21: advisory: Advisory updated with additional testing and validation

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.