Advisory GHSA-xhj3-7xw9-vr34 references a vulnerability in the following Go modules:
Description:
Summary
An uncontrolled resource consumption vulnerability in openapi3filter lets any unauthenticated client force multi-gigabyte heap allocation with a single, tiny HTTP request. When a spec declares a deepObject-style query parameter whose schema contains an array (a normal, documented pattern), the decoder reconstructs the array by reading the largest attacker-supplied index and allocating one slot for every position from 0 up to that index — before schema validation (including maxItems) ever runs. A request as small as 24 bytes (?param[items][50000000]=x) drives heap...
References:
Cross references:
- github.com/getkin/kin-openapi appears in 3 other report(s):
See doc/quickstart.md for instructions on how to triage this report.
id: GO-ID-PENDING
modules:
- module: github.com/getkin/kin-openapi
versions:
- introduced: 0.124.0
- fixed: 0.142.0
vulnerable_at: 0.141.0
summary: |-
kin-openapi has uncontrolled resource consumption in openapi3filter deepObject
query parameter decoding in github.com/getkin/kin-openapi
cves:
- CVE-2026-77354
ghsas:
- GHSA-xhj3-7xw9-vr34
references:
- advisory: https://github.com/advisories/GHSA-xhj3-7xw9-vr34
- advisory: https://github.com/getkin/kin-openapi/security/advisories/GHSA-xhj3-7xw9-vr34
- fix: https://github.com/getkin/kin-openapi/commit/1223a0f215d2cf9beb2d9eb9ea2649d001c21388
- web: https://github.com/getkin/kin-openapi/releases/tag/v0.142.0
source:
id: GHSA-xhj3-7xw9-vr34
created: 2026-08-21T21:01:20.905830364Z
review_status: UNREVIEWED
Advisory GHSA-xhj3-7xw9-vr34 references a vulnerability in the following Go modules:
Description:
Summary
An uncontrolled resource consumption vulnerability in
openapi3filterlets any unauthenticated client force multi-gigabyte heap allocation with a single, tiny HTTP request. When a spec declares adeepObject-style query parameter whose schema contains an array (a normal, documented pattern), the decoder reconstructs the array by reading the largest attacker-supplied index and allocating one slot for every position from0up to that index — before schema validation (includingmaxItems) ever runs. A request as small as 24 bytes (?param[items][50000000]=x) drives heap...References:
Cross references:
See doc/quickstart.md for instructions on how to triage this report.