https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Wed, 26 Aug 2026 14:12:14 +0000 https://vulnerability.circl.lu/sighting/f51578bd-41b5-4ddd-95eb-68dd08c8f7c5/export {"uuid": "f51578bd-41b5-4ddd-95eb-68dd08c8f7c5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-77354", "type": "seen", "source": "https://gist.github.com/alon710/7c54eba19cd97d405397b38bde10ad0d", "content": "# CVE-2026-77354: CVE-2026-77354: Uncontrolled Resource Consumption (OOM) via Sparse Array Indexes in kin-openapi\n\n> **CVSS Score:** 8.7\n> **Published:** 2026-08-21\n> **Full Report:** https://cvereports.com/reports/CVE-2026-77354\n\n## Summary\nAn uncontrolled resource consumption vulnerability (CWE-400/CWE-789) exists within the kin-openapi Go library prior to version 0.142.0. The vulnerability occurs during the processing of highly sparse array indexes inside query parameters defined in deepObject style. An unauthenticated remote attacker can exploit this flaw to cause an immediate Out-of-Memory (OOM) crash of the target application.\n\n## TL;DR\nAn unauthenticated remote attacker can crash Go services using kin-openapi (openapi3filter) by passing a highly sparse array index in a deepObject query parameter, causing massive memory allocations before validation takes place.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-400, CWE-789\n- **Attack Vector**: Network\n- **CVSS v4.0 Score**: 8.7 (High)\n- **EPSS Score**: Not Available\n- **Impact**: Denial of Service (OOM Process Crash)\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Go applications implementing github.com/getkin/kin-openapi/openapi3filter\n- **kin-openapi**: >= 0.124.0, < 0.142.0 (Fixed in: `0.142.0`)\n\n## Mitigation\n\n- Upgrade github.com/getkin/kin-openapi dependency to version 0.142.0 or higher.\n- Deploy WAF filter rules to intercept and inspect query parameter patterns containing large index values.\n- Implement aggressive container resource limits to contain the impact of Out-Of-Memory crashes.\n\n**Remediation Steps:**\n1. Identify all internal Go projects referencing 'github.com/getkin/kin-openapi'.\n2. Modify go.mod files to point to 'github.com/getkin/kin-openapi v0.142.0' or later.\n3. Run 'go mod tidy' to update dependency trees and rebuild services.\n4. Verify the application handles parameters correctly by verifying test inputs with sparse arrays are rejected.\n\n## References\n\n- [GHSA-xhj3-7xw9-vr34: Out of memory vulnerability in getkin/kin-openapi](https://github.com/getkin/kin-openapi/security/advisories/GHSA-xhj3-7xw9-vr34)\n- [Pull Request #923: deepObject support for array values](https://github.com/getkin/kin-openapi/pull/923)\n- [Fix Commit 1223a0f](https://github.com/getkin/kin-openapi/commit/1223a0f215d2cf9beb2d9eb9ea2649d001c21388)\n- [Release v0.142.0](https://github.com/getkin/kin-openapi/releases/tag/v0.142.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-77354) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-22T02:31:53.738691Z"} {"uuid": "f51578bd-41b5-4ddd-95eb-68dd08c8f7c5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-77354", "type": "seen", "source": "https://gist.github.com/alon710/7c54eba19cd97d405397b38bde10ad0d", "content": "# CVE-2026-77354: CVE-2026-77354: Uncontrolled Resource Consumption (OOM) via Sparse Array Indexes in kin-openapi\n\n> **CVSS Score:** 8.7\n> **Published:** 2026-08-21\n> **Full Report:** https://cvereports.com/reports/CVE-2026-77354\n\n## Summary\nAn uncontrolled resource consumption vulnerability (CWE-400/CWE-789) exists within the kin-openapi Go library prior to version 0.142.0. The vulnerability occurs during the processing of highly sparse array indexes inside query parameters defined in deepObject style. An unauthenticated remote attacker can exploit this flaw to cause an immediate Out-of-Memory (OOM) crash of the target application.\n\n## TL;DR\nAn unauthenticated remote attacker can crash Go services using kin-openapi (openapi3filter) by passing a highly sparse array index in a deepObject query parameter, causing massive memory allocations before validation takes place.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-400, CWE-789\n- **Attack Vector**: Network\n- **CVSS v4.0 Score**: 8.7 (High)\n- **EPSS Score**: Not Available\n- **Impact**: Denial of Service (OOM Process Crash)\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Go applications implementing github.com/getkin/kin-openapi/openapi3filter\n- **kin-openapi**: >= 0.124.0, < 0.142.0 (Fixed in: `0.142.0`)\n\n## Mitigation\n\n- Upgrade github.com/getkin/kin-openapi dependency to version 0.142.0 or higher.\n- Deploy WAF filter rules to intercept and inspect query parameter patterns containing large index values.\n- Implement aggressive container resource limits to contain the impact of Out-Of-Memory crashes.\n\n**Remediation Steps:**\n1. Identify all internal Go projects referencing 'github.com/getkin/kin-openapi'.\n2. Modify go.mod files to point to 'github.com/getkin/kin-openapi v0.142.0' or later.\n3. Run 'go mod tidy' to update dependency trees and rebuild services.\n4. Verify the application handles parameters correctly by verifying test inputs with sparse arrays are rejected.\n\n## References\n\n- [GHSA-xhj3-7xw9-vr34: Out of memory vulnerability in getkin/kin-openapi](https://github.com/getkin/kin-openapi/security/advisories/GHSA-xhj3-7xw9-vr34)\n- [Pull Request #923: deepObject support for array values](https://github.com/getkin/kin-openapi/pull/923)\n- [Fix Commit 1223a0f](https://github.com/getkin/kin-openapi/commit/1223a0f215d2cf9beb2d9eb9ea2649d001c21388)\n- [Release v0.142.0](https://github.com/getkin/kin-openapi/releases/tag/v0.142.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-77354) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-22T02:31:53.738691Z"} https://vulnerability.circl.lu/sighting/f51578bd-41b5-4ddd-95eb-68dd08c8f7c5/export Sat, 22 Aug 2026 02:31:53 +0000 https://vulnerability.circl.lu/sighting/cad437b7-525e-4a46-9c6d-dc6e7e4ce67b/export {"uuid": "cad437b7-525e-4a46-9c6d-dc6e7e4ce67b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-77354", "type": "published-proof-of-concept", "source": "https://github.com/getkin/kin-openapi/security/advisories/GHSA-xhj3-7xw9-vr34", "content": "", "creation_timestamp": "2026-08-21T22:35:12.887281Z"} {"uuid": "cad437b7-525e-4a46-9c6d-dc6e7e4ce67b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-77354", "type": "published-proof-of-concept", "source": "https://github.com/getkin/kin-openapi/security/advisories/GHSA-xhj3-7xw9-vr34", "content": "", "creation_timestamp": "2026-08-21T22:35:12.887281Z"} https://vulnerability.circl.lu/sighting/cad437b7-525e-4a46-9c6d-dc6e7e4ce67b/export Fri, 21 Aug 2026 22:35:12 +0000