getkin kin-openapi up to 0.141.x DeepObject Query Parameter req_resp_decoder.go openapi3filter.sliceMapToSlice deepObject query parameter allocation of resources

Summaryinfo

A vulnerability marked as problematic has been reported in getkin kin-openapi up to 0.141.x. Impacted is the function openapi3filter.sliceMapToSlice of the file openapi3filter/req_resp_decoder.go of the component DeepObject Query Parameter Handler. The manipulation of the argument deepObject query parameter leads to allocation of resources. This vulnerability is listed as CVE-2026-77354. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability was found in getkin kin-openapi up to 0.141.x and classified as problematic. This issue affects the function openapi3filter.sliceMapToSlice of the file openapi3filter/req_resp_decoder.go of the component DeepObject Query Parameter Handler. The manipulation of the argument deepObject query parameter with an unknown input leads to a allocation of resources vulnerability. Using CWE to declare the problem leads to CWE-770. The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor. Impacted is availability. The summary by CVE is:

kin-openapi is a Go project for handling OpenAPI files. From 0.124.0 until 0.142.0, openapi3filter.sliceMapToSlice in openapi3filter/req_resp_decoder.go converts attacker-controlled sparse indexes from a deepObject query parameter into a dense slice by allocating entries from zero through the largest supplied index, after which buildResObj creates another slice of the same length. This allocation occurs before schema validation, so maxItems does not prevent it. An unauthenticated client can send a small query such as param[items][50000000]=x to an endpoint whose deepObject schema contains an array, forcing multi-gigabyte heap allocation and causing an OOM kill or restart loop. Other request-body encodings and styled parameters that do not produce bracketed integer indexes are not affected. This issue is fixed in version 0.142.0.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-77354 since 08/20/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1499 according to MITRE ATT&CK.

The vulnerability scanner Nessus provides a plugin with the ID 338846 (Linux Distros Unpatched Vulnerability : CVE-2026-77354), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 0.142.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (338846). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• getkin

Name

• kin-openapi

Version

• 0.141

Website

• Product: https://github.com/getkin/kin-openapi/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion