https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 00:44:13 +0000 https://vulnerability.circl.lu/vuln/ghsa-jpcw-4wr7-c3vq <p><strong>Affected:</strong> Go: github.com/getkin/kin-openapi</p> <p>| Field | Value | |---|---| | Ecosystem | Go | | Package | `github.com/getkin/kin-openapi` | | Affected versions | `&lt;= 0.143.0` (introduced in `v0.2.0`, PR #90, 2019-05-07; reproduced on `HEAD` `30e2923`) | | Patched versions | 0.144.0 | ---</p> <p>### Summary</p> <p>`openapi3filter.ValidateRequest` contains a NULL-pointer-dereference denial of service: any **unauthenticated** client can crash the request-validation path with a **single** HTTP request. When an operation declares a `content` parameter (as opposed to a `schema` parameter) whose media type object has **no `schema`**, request validation dereferences that missing schema and panics. The document is legal under the OpenAPI Specification — kin-openapi&#39;s own `doc.Validate()` accepts it — and the defect affects **both OpenAPI 3.0.x and 3.1.x**. Depending on how the library is wired into the server (see Impact), this ranges from a per-request abort with unbounded panic-log growth to a full remote process crash.</p> <p>### Details</p> <p>The decoder used for `content` parameters when no custom `ParamDecoder` is configured (the library default), `defaultContentParameterDecoder`, dereferences the media-type schema without a nil check.</p> <p>`openapi3filter/req_resp_decoder.go`, around line 197:</p> <p>```go mt := content.Get(&#34;application/json&#34;) if mt == nil { // media-type OBJECT is guarded ... err = fmt.Errorf(&#34;parameter %q has no content schema&#34;, param.Name) return } outSchema = mt.Schema.Value // ... but mt.Schema…</p> <p><strong>Affected:</strong> Go: github.com/getkin/kin-openapi</p> <p>| Field | Value | |---|---| | Ecosystem | Go | | Package | `github.com/getkin/kin-openapi` | | Affected versions | `&lt;= 0.143.0` (introduced in `v0.2.0`, PR #90, 2019-05-07; reproduced on `HEAD` `30e2923`) | | Patched versions | 0.144.0 | ---</p> <p>### Summary</p> <p>`openapi3filter.ValidateRequest` contains a NULL-pointer-dereference denial of service: any **unauthenticated** client can crash the request-validation path with a **single** HTTP request. When an operation declares a `content` parameter (as opposed to a `schema` parameter) whose media type object has **no `schema`**, request validation dereferences that missing schema and panics. The document is legal under the OpenAPI Specification — kin-openapi&#39;s own `doc.Validate()` accepts it — and the defect affects **both OpenAPI 3.0.x and 3.1.x**. Depending on how the library is wired into the server (see Impact), this ranges from a per-request abort with unbounded panic-log growth to a full remote process crash.</p> <p>### Details</p> <p>The decoder used for `content` parameters when no custom `ParamDecoder` is configured (the library default), `defaultContentParameterDecoder`, dereferences the media-type schema without a nil check.</p> <p>`openapi3filter/req_resp_decoder.go`, around line 197:</p> <p>```go mt := content.Get(&#34;application/json&#34;) if mt == nil { // media-type OBJECT is guarded ... err = fmt.Errorf(&#34;parameter %q has no content schema&#34;, param.Name) return } outSchema = mt.Schema.Value // ... but mt.Schema…</p> https://vulnerability.circl.lu/vuln/ghsa-jpcw-4wr7-c3vq