Skip to content
OpenAdvisories
High · 7.5 CVE-2026-76905 EUVD-2026-64150GHSA-mmfr-pmjx-hw9wGO-2026-6274

kin-openapi openai3filter: nil-pointer panic in ConvertErrors on malformed multipart/form-data body enables unauthenticated DoS

Published Aug 21, 2026 · Updated Aug 25, 2026 · Assigned by GitHub_M

Description

kin-openapi is a Go project for handling OpenAPI files. From 0.10.0 until 0.141.0, openapi3filter.convertParseError in openapi3filter/validation_error_encoder.go dereferences e.Parameter.In without checking whether e.Parameter is nil. A malformed non-string scalar field in a multipart/form-data request body produces a nested ParseError with a nil RequestError.Parameter, and applications that render the validation error through openapi3filter.ConvertErrors or ValidationErrorEncoder panic. An unauthenticated client can repeatedly send such requests to deny service when the application lacks a recovery boundary. JSON request bodies and applications that do not use these error-rendering helpers are not affected. This issue is fixed in version 0.141.0.

Affected products

VendorProductAffectedFixed
getkin kin-openapi >= 0.10.0, < 0.141.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 golang-github-getkin-kin-openapi No fix yet —
Debian 13 golang-github-getkin-kin-openapi No fix yet —
Debian 12 golang-github-getkin-kin-openapi No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 golang-github-getkin-kin-openapi No fix yet —
Ubuntu 26.04 LTS golang-github-getkin-kin-openapi No fix yet —
Ubuntu 24.04 LTS golang-github-getkin-kin-openapi No fix yet —
Ubuntu 22.04 LTS golang-github-getkin-kin-openapi No fix yet —
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 govulncheck-vulndb 0.0.20260827T195228-160000.1.1 SUSE-SU-2026:23625-1
SLES 16.0 govulncheck-vulndb 0.0.20260827T195228-160000.1.1 SUSE-SU-2026:23625-1
ReleasePackageFixed inAdvisory
openSUSE Leap 16.0 govulncheck-vulndb 0.0.20260827T195228-160000.1.1 openSUSE-SU-2026:21761-1

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling gptscript +1 No fix yet —

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/getkin/kin-openapi >= 0.10.0, < 0.141.0 0.141.0 GHSA-mmfr-pmjx-hw9w

Advisories 2

References