https://vulnerability.circl.lu/sightings/feed 2026-08-25T15:04:33.718837+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/ae973445-f04f-4bba-9159-b5571e11c2d7/export 2026-08-25T15:04:33.735111+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "ae973445-f04f-4bba-9159-b5571e11c2d7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-76905", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117138842245004180", "content": "CVE-2026-76905 - Unpatched DoS in kin-openapi. Malformed multipart request triggers nil pointer panic in error handling. CVSS 7.5. No fix yet - monitor for updates and apply workarounds. #CVE #infosec #Go\nhttps://www.valtersit.com/cve/CVE-2026-76905/", "creation_timestamp": "2026-08-22T11:08:08.931388Z"} 2026-08-22T11:08:08.931388+00:00 https://vulnerability.circl.lu/sighting/218447cd-63c4-4ebf-b4da-c42d4686491a/export 2026-08-25T15:04:33.737173+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "218447cd-63c4-4ebf-b4da-c42d4686491a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-76905", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mto53nthtb2o", "content": "CVE-2026-76905 - Unpatched DoS in kin-openapi. Malformed multipart request triggers nil pointer panic in error handling. CVSS 7.5. No fix yet - monitor for updates and apply workarounds. #CVE #infosec #Go\n\nhttps://www.valtersit.com/cve/CVE-2026-76905/", "creation_timestamp": "2026-08-22T11:07:46.166292Z"} 2026-08-22T11:07:46.166292+00:00 https://vulnerability.circl.lu/sighting/a15e4f4a-e17b-4271-aad9-8beb0131e154/export 2026-08-25T15:04:33.737337+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "a15e4f4a-e17b-4271-aad9-8beb0131e154", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-76905", "type": "seen", "source": "https://gist.github.com/alon710/a8fb06e2d4be25e5dcde47f19754cbdb", "content": "# CVE-2026-76905: CVE-2026-76905: Denial of Service via Nil-Pointer Dereference in getkin/kin-openapi openapi3filter\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-08-21\n> **Full Report:** https://cvereports.com/reports/CVE-2026-76905\n\n## Summary\nCVE-2026-76905 is a high-severity Denial of Service (DoS) vulnerability in the getkin/kin-openapi library, specifically inside the openapi3filter sub-package. When processing multipart/form-data request validation errors, a missing nil-pointer guard causes a Go runtime panic during error formatting. This panic terminates the active server process if no recovery handler is present, resulting in a total denial of service. The vulnerability affects versions from v0.10.0 to v0.140.0, and is resolved in v0.141.0.\n\n## TL;DR\nUnauthenticated remote attackers can crash servers using getkin/kin-openapi (v0.10.0 to v0.140.0) by transmitting a malformed multipart/form-data request, triggering a nil-pointer dereference panic in the error validation encoder.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-476\n- **Attack Vector**: Network\n- **CVSS Score**: 7.5\n- **EPSS Percentile**: N/A\n- **Impact**: Denial of Service (DoS)\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Go applications using getkin/kin-openapi in combination with openapi3filter validation handlers.\n- **github.com/getkin/kin-openapi**: >= 0.10.0, < 0.141.0 (Fixed in: `v0.141.0`)\n\n## Mitigation\n\n- Upgrade to getkin/kin-openapi v0.141.0 or newer.\n- Deploy a panic recovery middleware helper at the HTTP handler layer to isolate and catch runtime panics.\n- Formulate client-side error responses using custom formatting wrappers that bypass the vulnerable ConvertErrors API.\n\n**Remediation Steps:**\n1. Open the active project directory containing the vulnerable go.mod file.\n2. Update the dependency to the patched version: go get github.com/getkin/kin-openapi@v0.141.0\n3. Verify and clean the dependency tree using: go mod tidy\n4. Verify the installation of panic-recovery middleware configurations at the root router level to guarantee fallback resilience.\n5. Recompile and redeploy the patched binaries to production environments.\n\n## References\n\n- [GitHub Security Advisory GHSA-mmfr-pmjx-hw9w](https://github.com/getkin/kin-openapi/security/advisories/GHSA-mmfr-pmjx-hw9w)\n- [Patch Commit 1d0a337c9b1570fab283be8a04c8af6e43b9a22c](https://github.com/getkin/kin-openapi/commit/1d0a337c9b1570fab283be8a04c8af6e43b9a22c)\n- [Release Tag v0.141.0](https://github.com/getkin/kin-openapi/releases/tag/v0.141.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-76905) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-22T05:32:17.976868Z"} 2026-08-22T05:32:17.976868+00:00 https://vulnerability.circl.lu/sighting/614843ea-7636-4d1f-9d0c-246ff9216278/export 2026-08-25T15:04:33.737428+00:00 Joseph Lee https://vulnerability.circl.lu/user/syspect {"uuid": "614843ea-7636-4d1f-9d0c-246ff9216278", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-76905", "type": "published-proof-of-concept", "source": "https://github.com/getkin/kin-openapi/security/advisories/GHSA-mmfr-pmjx-hw9w", "content": "", "creation_timestamp": "2026-08-21T22:35:17.388189Z"} 2026-08-21T22:35:17.388189+00:00 https://vulnerability.circl.lu/sighting/9c466684-e0ce-477a-bc95-b95569ab4c0b/export 2026-08-25T15:04:33.738149+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "9c466684-e0ce-477a-bc95-b95569ab4c0b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-76905", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mtmr4fj5tb26", "content": "\ud83d\udfe0 CVE-2026-76905 - High (7.5)\n\nkin-openapi is a Go project for handling OpenAPI files. From 0.10.0 until 0.141.0, openapi3filter...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-76905/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-21T22:00:46.920423Z"} 2026-08-21T22:00:46.920423+00:00