Skip to content
OpenAdvisories
Medium · 5.3 CVE-2026-73502 EUVD-2026-61142GHSA-jpcw-4wr7-c3vqGO-2026-6112

kin-openapi openapi3filter: unauthenticated nil-pointer panic when validating a request against a `content` parameter whose media type has no schema

Published Aug 18, 2026 · Updated Aug 18, 2026 · Assigned by GitHub_M

Vendor: getkin Product: kin-openapi Package: crossplane-provider-aws-cloudformation Package: crossplane-provider-aws-cloudfront Package: crossplane-provider-aws-cloudwatchlogs Package: crossplane-provider-aws-dynamodb Package: crossplane-provider-aws-ec2 Package: crossplane-provider-aws-ec2-compat Package: crossplane-provider-aws-eks Package: crossplane-provider-aws-elasticache Package: crossplane-provider-aws-firehose Package: crossplane-provider-aws-iam Package: crossplane-provider-aws-kinesis Package: crossplane-provider-aws-kms Package: crossplane-provider-aws-lambda Package: crossplane-provider-aws-memorydb Package: crossplane-provider-aws-rds Package: crossplane-provider-aws-route53 Package: crossplane-provider-aws-route53-compat Package: crossplane-provider-aws-s3 Package: crossplane-provider-aws-sns Package: crossplane-provider-aws-sqs Package: crossplane-provider-azure-authorization Package: crossplane-provider-azure-managedidentity Package: crossplane-provider-azure-sql Package: crossplane-provider-azure-sql-compat Package: crossplane-provider-azure-storage Package: crossplane-provider-family-aws Package: crossplane-provider-family-azure Package: crossplane-provider-keycloak Package: dataplaneapi Package: github.com/getkin/kin-openapi Package: gitness Package: golang-github-getkin-kin-openapi Package: golang-github-getkin-kin-openapi Package: gptscript Package: grafana-12.3 Package: grafana-12.4 Package: grafana-13.0 Package: hugo Package: hugo-extended Package: kubevela-vela-cli Package: kubevela-vela-core Package: nuclei Package: terraform-provider-grafana Package: timoni Ecosystem: Debian Ecosystem: Go Ecosystem: Ubuntu Ecosystem: Wolfi

Description

kin-openapi is a Go project for handling OpenAPI files. From 0.2.0 until 0.144.0, openapi3filter.ValidateRequest can encounter a NULL-pointer-dereference denial of service when an operation declares a content parameter whose application/json media type has no schema. In openapi3filter/req_resp_decoder.go, the default defaultContentParameterDecoder dereferences mt.Schema.Value without checking whether mt.Schema is nil, even though doc.Validate() accepts the document under OpenAPI 3.0.x and 3.1.x. A single unauthenticated request supplying the parameter value can panic request validation, causing an aborted request with log growth in the common synchronous net/http path or a full process crash in integrations without recovery. This issue is fixed in version 0.144.0.

Affected products

VendorProductAffectedFixed
getkin kin-openapi >= 0.2.0, < 0.144.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 golang-github-getkin-kin-openapi No fix yet —
Debian 13 golang-github-getkin-kin-openapi No fix yet —
Debian 12 golang-github-getkin-kin-openapi No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 golang-github-getkin-kin-openapi No fix yet —
Ubuntu 26.04 LTS golang-github-getkin-kin-openapi No fix yet —
Ubuntu 24.04 LTS golang-github-getkin-kin-openapi No fix yet —
Ubuntu 22.04 LTS golang-github-getkin-kin-openapi No fix yet —
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 govulncheck-vulndb 0.0.20260827T195228-160000.1.1 SUSE-SU-2026:23625-1
SLES 16.0 govulncheck-vulndb 0.0.20260827T195228-160000.1.1 SUSE-SU-2026:23625-1
ReleasePackageFixed inAdvisory
openSUSE Leap 16.0 govulncheck-vulndb 0.0.20260827T195228-160000.1.1 openSUSE-SU-2026:21761-1

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling crossplane-provider-aws-cloudfront 2.6.0-r5 —
Wolfi rolling crossplane-provider-aws-ec2 +2 2.6.0-r6 —
Wolfi rolling crossplane-provider-aws-ec2-compat +2 2.7.0-r6 —
Wolfi rolling crossplane-provider-aws-iam +2 2.6.0-r8 —
Wolfi rolling crossplane-provider-aws-s3 +11 2.6.0-r7 —
Wolfi rolling crossplane-provider-azure-authorization 2.6.0-r11 —
Wolfi rolling crossplane-provider-azure-sql +2 2.6.0-r9 —
Wolfi rolling crossplane-provider-azure-storage 2.6.0-r10 —
Wolfi rolling crossplane-provider-keycloak 2.24.0-r4 —
Wolfi rolling dataplaneapi 3.4.0-r5 —
Wolfi rolling gitness 3.3.0-r29 —
Wolfi rolling gptscript No fix yet —
Wolfi rolling grafana-12.3 12.3.9-r3 —
Wolfi rolling grafana-12.4 12.4.6-r3 —
Wolfi rolling grafana-13.0 13.0.4-r7 —
Wolfi rolling hugo 0.164.0-r4 —
Wolfi rolling hugo-extended 0.164.0-r3 —
Wolfi rolling kubevela-vela-cli +1 1.11.0-r3 —
Wolfi rolling nuclei 3.11.1-r0 —
Wolfi rolling terraform-provider-grafana 4.44.0-r1 —
Wolfi rolling timoni 0.27.1-r1 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/getkin/kin-openapi < 0.144.0 0.144.0 GHSA-jpcw-4wr7-c3vq

Advisories 2

References