Executive brief
A vulnerability in the kin-openapi Go library can allow an unauthenticated attacker to crash a web service or cause it to stop responding. This occurs when the library processes a specially crafted request against an OpenAPI specification that contains certain parameter configurations. Depending on how the software is configured, this could lead to a temporary service disruption or a complete application crash.
Technical details
A NULL-pointer dereference exists in `openapi3filter.ValidateRequest` within the `defaultContentParameterDecoder` function. When an OpenAPI operation defines a `content` parameter whose media type object lacks a `schema`, the library fails to perform a nil check before dereferencing `mt.Schema.Value`. An unauthenticated attacker can trigger this panic by sending a single HTTP request to an affected endpoint. The impact varies by implementation: in standard `net/http` environments, it causes a per-request panic and log exhaustion, while in async goroutines or non-standard hosts, it can crash the entire process. This affects both OpenAPI 3.0.x and 3.1.x specifications. A fix is available in version 0.144.0.
Affected products
- getkin kin-openapi <= 0.143.0
Timeline
- 2019-05-07: other: Vulnerability introduced in v0.2.0 (PR #90)
- 2026-07-23: advisory: GitHub Advisory published
- 2026-07-24: patched: Version 0.144.0 released
References
- https://api.github.com/users/matiasinsaurralde
- https://github.com/matiasinsaurralde
- https://api.github.com/users/matiasinsaurralde/gists%7B/gist_id%7D
- https://api.github.com/users/matiasinsaurralde/repos
- https://avatars.githubusercontent.com/u/20110?v=4
- https://api.github.com/users/matiasinsaurralde/events%7B/privacy%7D