CVE-2026-73502Medium· 5.3▾ Sunlitkin-openapi is a Go project for handling OpenAPI files. From 0.2.0 until 0.144.0, openapi3filter.ValidateRequest can encounter a NULL-pointer-dereference denial of service when an operation declares a content parameter whose application/…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 19.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.5%
Last analysed / modified upstream
kin-openapi is a Go project for handling OpenAPI files. From 0.2.0 until 0.144.0, openapi3filter.ValidateRequest can encounter a NULL-pointer-dereference denial of service when an operation declares a content parameter whose application/json media type has no schema. In openapi3filter/req_resp_decoder.go, the default defaultContentParameterDecoder dereferences mt.Schema.Value without checking whether mt.Schema is nil, even though doc.Validate() accepts the document under OpenAPI 3.0.x and 3.1.x. A single unauthenticated request supplying the parameter value can panic request validation, causing an aborted request with log growth in the common synchronous net/http path or a full process crash in integrations without recovery. This issue is fixed in version 0.144.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
github.com/getkin/kin-openapi < 0.144.0Patched in:
github.com/getkin/kin-openapi 0.144.0Source: https://osv.dev/vulnerability/GHSA-jpcw-4wr7-c3vq
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-73501Critical· 9.1kin-openapi is a Go project for handling OpenAPI files
CVE-2026-76905High· 7.5kin-openapi is a Go project for handling OpenAPI files
CVE-2022-23526High· 7.5helm: Denial of service through schema file (CVE-2022-23526)
CVE-2022-23525High· 7.5helm: Denial of service through through repository index file (CVE-2022-23525)
CVE-2026-48050High· 8.2Arc is an open, SQL-native time-series database for telemetry
CVE-2026-76781Medium· 5.5A flaw was found in libxml2