CVE-2026-72582 in fastschema
Summary
by MITRE • 08/10/2026
A NULL pointer dereference vulnerability in fastschema through v0.15.1 allows an unauthenticated remote attacker to crash the server process with a single HTTP request. The sendOTPEmail function in pkg/auth/local.go dereferences a pointer obtained from an unchecked error path without validating it is non-nil, causing a fatal panic that terminates the entire server when a recovery request is sent to the /api/auth/local/recover endpoint.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
This vulnerability represents a critical null pointer dereference flaw in the fastschema authentication system that can be exploited by unauthenticated remote attackers to achieve remote denial of service. The issue resides within the sendOTPEmail function located in pkg/auth/local.go, where the application fails to validate pointer return values from error handling paths before attempting to dereference them. This fundamental failure in input validation creates a condition where a malicious actor can craft a specific HTTP request to the /api/auth/local/recover endpoint that triggers an immediate server crash.
The technical execution of this vulnerability occurs through a single HTTP request that exploits the unchecked error path within the authentication recovery mechanism. When the recover endpoint processes the request, it calls the sendOTPEmail function which retrieves a pointer value from an error handling routine without first verifying that the pointer is not nil. This unchecked pointer dereference directly violates security principles outlined in CWE-476 which specifically addresses null pointer dereference vulnerabilities. The consequence is a fatal panic condition that terminates the entire server process, effectively providing an attacker with complete control over service availability.
From an operational impact perspective, this vulnerability presents a severe risk to system availability and can be exploited without any authentication requirements, making it particularly dangerous in production environments. The single request nature of the exploit means that attackers can quickly and easily disrupt service operations, potentially causing extended downtime while administrators must restart the server process. This type of vulnerability aligns with ATT&CK technique T1499.004 which covers network denial of service attacks through application-level disruptions.
The root cause of this vulnerability demonstrates poor defensive programming practices where error handling paths are not properly validated before pointer operations occur. Security best practices dictate that all pointer values obtained from external inputs or function calls must be validated for nullity before dereferencing, a principle that should be enforced throughout the application's authentication flow. Organizations deploying fastschema versions through v0.15.1 face immediate risk of service disruption and should implement both immediate mitigations and long-term code review processes to prevent similar issues in other components.
The vulnerability's impact extends beyond simple server crashes as it can be used as part of broader attack strategies where attackers might combine this with other exploits or use it to mask more sophisticated attacks. The lack of proper error handling validation represents a fundamental architectural weakness that could potentially lead to information disclosure or privilege escalation if additional vulnerabilities exist within the same code path. Organizations should prioritize immediate patching of affected versions while implementing monitoring for suspicious requests to the recovery endpoint and establishing robust input validation procedures across all authentication-related functions.