CVE-2026-76905High· 7.5▾ Twilightkin-openapi is a Go project for handling OpenAPI files. From 0.10.0 until 0.141.0, openapi3filter.convertParseError in openapi3filter/validation_error_encoder.go dereferences e.Parameter.In without checking whether e.Parameter is nil. A …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 22.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.4%
Last analysed / modified upstream
7.5 → 5.3
high → medium
5.3 → 7.5
medium → high
7.5 → 5.3
high → medium
5.3 → 7.5
medium → high
7.5 → 5.3
high → medium
5.3 → 7.5
medium → high
0.4% → 0.4%
kin-openapi is a Go project for handling OpenAPI files. From 0.10.0 until 0.141.0, openapi3filter.convertParseError in openapi3filter/validation_error_encoder.go dereferences e.Parameter.In without checking whether e.Parameter is nil. A malformed non-string scalar field in a multipart/form-data request body produces a nested ParseError with a nil RequestError.Parameter, and applications that render the validation error through openapi3filter.ConvertErrors or ValidationErrorEncoder panic. An unauthenticated client can repeatedly send such requests to deny service when the application lacks a recovery boundary. JSON request bodies and applications that do not use these error-rendering helpers are not affected. This issue is fixed in version 0.141.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
github.com/getkin/kin-openapi >= 0.10.0, < 0.141.0Patched in:
github.com/getkin/kin-openapi 0.141.0Source: https://github.com/advisories/GHSA-mmfr-pmjx-hw9w
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-73502Medium· 5.3kin-openapi is a Go project for handling OpenAPI files
CVE-2022-23526High· 7.5helm: Denial of service through schema file (CVE-2022-23526)
CVE-2022-23525High· 7.5helm: Denial of service through through repository index file (CVE-2022-23525)
CVE-2026-73501Critical· 9.1kin-openapi is a Go project for handling OpenAPI files
CVE-2026-48050High· 8.2Arc is an open, SQL-native time-series database for telemetry
CVE-2026-76781Medium· 5.5A flaw was found in libxml2