Executive brief
kin-openapi is a Go library used to validate HTTP requests against OpenAPI specifications. An attacker can send a single small HTTP request (as few as 24 bytes) to force a server using this library to allocate multiple gigabytes of memory, causing an out-of-memory crash and service restart loop. This happens when the OpenAPI spec declares a query parameter with deepObject-style encoding and an array schema—a normal, documented pattern.
Technical details
The vulnerability is a CWE-789 / CWE-400 uncontrolled resource consumption flaw in the sliceMapToSlice and buildResObj functions in req_resp_decoder.go. When decoding deepObject-style query parameters (e.g., ?param[items][0]=a¶m[items][1]=b), the decoder reconstructs arrays from a sparse map keyed by string indices. It allocates one slot for every position from 0 up to the largest attacker-supplied index N, creating an array of size N+1 without bounds checking. A request with ?param[items][50000000]=x (24 bytes) produces approximately 6.1 GiB of heap allocation. The attack requires only an unauthenticated network request; no authentication or special preconditions are needed. The target spec must declare a query parameter with in: query, style: deepObject, and a schema containing an array—a standard OpenAPI pattern. Critically, schema validation (including maxItems constraints) runs strictly after decoding completes, so declared limits do not prevent the allocation. The vulnerability was introduced in v0.124.0 (commit 78bb273, March 2024) and affects all versions through v0.141.0. A patch is available in v0.142.0.
Affected products
- getkin kin-openapi >=0.124.0, <0.142.0
Timeline
- 2026-07-11: disclosed: Published in GitHub Advisory Database
- 2026: patched: Fix released in v0.142.0
- 2026-08-21: advisory: Advisory updated with additional testing and validation
References
- https://api.github.com/users/matiasinsaurralde
- https://github.com/matiasinsaurralde
- https://api.github.com/users/matiasinsaurralde/gists%7B/gist_id%7D
- https://api.github.com/users/matiasinsaurralde/repos
- https://avatars.githubusercontent.com/u/20110?v=4
- https://api.github.com/users/matiasinsaurralde/events%7B/privacy%7D