Description
kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.143.0, openapi3filter accepts OpenAPI 3.1 array schemas without an items keyword and then dereferences the nil Schema.Items value while decoding application/x-www-form-urlencoded or multipart/form-data request bodies, response headers, and other array parameter surfaces. A remote unauthenticated client can reach an affected operation with a nonempty request or matching response and deterministically trigger a nil-pointer panic during ValidateRequest or ValidateResponse. OpenAPI 3.0 documents are not affected because document validation rejects arrays without items, and JSON request bodies use a different decoder path. This issue is fixed in version 0.143.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| getkin | kin-openapi | >= 0.136.0, < 0.143.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | golang-github-getkin-kin-openapi | No fix yet | — |
| Ubuntu 26.04 LTS | golang-github-getkin-kin-openapi | No fix yet | — |
| Ubuntu 24.04 LTS | golang-github-getkin-kin-openapi | No fix yet | — |
| Ubuntu 22.04 LTS | golang-github-getkin-kin-openapi | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | grafana12.4 | 12.4.12-0.4.hum1 | RHSA-2026:76677 |
| Red Hat Hardened Images 1 | grafana13.1 | 13.1.7-0.1.hum1 | RHSA-2026:76448 |
| Red Hat Hardened Images 1 | grafana13.2 | 13.2.3-0.1.hum1 | RHSA-2026:76430 |
| Red Hat Hardened Images 1 | hugo | 0.168.0-0.1.hum1 | RHSA-2026:82637 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/getkin/kin-openapi | >= 0.136.0, < 0.143.0 | 0.143.0 | GHSA-p6wj-qrr4-pgh5 |
Advisories 4
- RHSA-2026:76448 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:82637 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:76677 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:76430 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026