Description

kin-openapi is a Go project for handling OpenAPI files. From 0.2.0 until 0.144.0, openapi3filter.ValidateRequest can encounter a NULL-pointer-dereference denial of service when an operation declares a content parameter whose application/json media type has no schema. In openapi3filter/req_resp_decoder.go, the default defaultContentParameterDecoder dereferences mt.Schema.Value without checking whether mt.Schema is nil, even though doc.Validate() accepts the document under OpenAPI 3.0.x and 3.1.x. A single unauthenticated request supplying the parameter value can panic request validation, causing an aborted request with log growth in the common synchronous net/http path or a full process crash in integrations without recovery. This issue is fixed in version 0.144.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-18T18:19:33.460Z",
  "pubdate": "2026-08-18T18:19:33.460Z",
  "executiveSummary": "A null-pointer-dereference denial of service vulnerability exists in the kin-openapi Go project affecting versions from 0.2.0 until 0.144.0.\nThe vulnerability arises within the openapi3filter.ValidateRequest function when processing an OpenAPI operation that declares a content parameter with an application/json media type lacking an explicit schema.\nAlthough such OpenAPI 3.0.x and 3.1.x documents pass document validation via doc.Validate(), the request decoding logic fails to validate the presence of the schema pointer.\nAn unauthenticated attacker can supply a specifically crafted request payload targeting this parameter value, triggering a runtime panic during request validation.\nDepending on the HTTP server architecture and error recovery implementation, this panic results in either aborted requests accompanied by excessive log growth in synchronous net/http paths or an unhandled process crash leading to a complete denial of service.\nExploitation requires no privileges or prior authentication, lowering the barrier for potential attackers to disrupt dependent services.",
  "technicalDetails": "The root cause of the vulnerability resides in the openapi3filter/req_resp_decoder.go source file within the default defaultContentParameterDecoder function.\nDuring request parsing and validation, the decoding logic unconditionally attempts to dereference mt.Schema.Value without first verifying whether the mt.Schema pointer is nil.\nThis condition is triggered when an OpenAPI 3.0.x or 3.1.x document defines an operation content parameter utilizing the application/json media type without a corresponding schema definition.\nBecause doc.Validate() successfully accepts documents missing media type schemas, developers can inadvertently deploy valid API definitions that harbor this latent defect.\nThe attack flow proceeds as follows: an unauthenticated threat actor transmits an HTTP request containing a value for the affected content parameter over the network.\nThe net/http server routes the request to the kin-openapi validation middleware executing openapi3filter.ValidateRequest.\nAs the decoder attempts to process the application/json media type without checking for a null schema reference, the application encounters an unhandled runtime null-pointer dereference.\nThis memory access violation generates a Go panic.\nIn standard synchronous net/http request handlers lacking explicit panic recovery middleware, the panic crashes the goroutine or the entire application process, resulting in an immediate denial of service.\nEven if internal recovery mechanisms capture the panic to abort the specific request, the repetitive triggering of the fault induces rapid and uncontrolled log growth, potentially exhausting disk space or degrading system performance.\nThe vulnerable component is identified as openapi3filter.ValidateRequest within the kin-openapi module, impacting versions 0.2.0 through 0.144.0.\nNetwork exposure is direct, as the endpoint responsible for request validation is typically exposed to external clients."
}