https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Wed, 29 Jul 2026 21:59:55 +0000 https://vulnerability.circl.lu/sighting/20279e3a-9438-409c-b03a-fa315d67cb54/export {"uuid": "20279e3a-9438-409c-b03a-fa315d67cb54", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-JPCW-4WR7-C3VQ", "type": "seen", "source": "https://gist.github.com/alon710/b490d29b6d050fb00e7a5ccf95bdfcac", "content": "# GHSA-JPCW-4WR7-C3VQ: GHSA-JPCW-4WR7-C3VQ: Remote Denial of Service via NULL Pointer Dereference in kin-openapi Parameter Validation\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-07-24\n> **Full Report:** https://cvereports.com/reports/GHSA-JPCW-4WR7-C3VQ\n\n## Summary\nA NULL pointer dereference vulnerability was discovered in the getkin/kin-openapi Go library. When parsing incoming request parameters that are validated against a content map with an empty media type, the openapi3filter request validation engine attempts to resolve an uninitialized schema pointer. This results in an unhandled Go runtime panic and process termination, yielding an unauthenticated, remote Denial of Service vector.\n\n## TL;DR\nUnauthenticated remote attackers can crash Go web servers using the kin-openapi validation middleware by sending a request containing a parameter whose media type has no defined schema, triggering a fatal NULL pointer dereference.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **Vulnerability ID**: GHSA-JPCW-4WR7-C3VQ\n- **CWE ID**: CWE-476 (Null Pointer Dereference)\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 7.5 (High)\n- **Exploit Status**: Proof of Concept (PoC) public\n- **CISA KEV Status**: Not Listed\n- **Impact**: Denial of Service (DoS)\n\n## Affected Systems\n\n- getkin/kin-openapi Go library and dependent API gateways/microservices\n- **kin-openapi**: < v0.144.0 (Fixed in: `v0.144.0`)\n\n## Mitigation\n\n- Upgrade kin-openapi dependency to version v0.144.0 or newer\n- Verify and audit OpenAPI schema files for parameter content objects without a schema\n- Implement Go runtime panic recovery middleware on HTTP handlers\n\n**Remediation Steps:**\n1. Run 'go get github.com/getkin/kin-openapi@v0.144.0' in the project root\n2. Run 'go mod tidy' to update the module dependencies\n3. Audit raw specification documents for query, header, or cookie parameters specifying content content maps without nested schema declarations\n4. Implement a central recovery block to ensure service survivability\n\n## References\n\n- [GitHub Security Advisory GHSA-JPCW-4WR7-C3VQ](https://github.com/advisories/GHSA-JPCW-4WR7-C3VQ)\n- [Fix Commit in kin-openapi](https://github.com/getkin/kin-openapi/commit/68ac2affa325514d7d6e731204d6a1edf6bdff64)\n- [v0.144.0 Release Notes](https://github.com/getkin/kin-openapi/releases/tag/v0.144.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-JPCW-4WR7-C3VQ) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-25T01:39:15.120197Z"} {"uuid": "20279e3a-9438-409c-b03a-fa315d67cb54", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-JPCW-4WR7-C3VQ", "type": "seen", "source": "https://gist.github.com/alon710/b490d29b6d050fb00e7a5ccf95bdfcac", "content": "# GHSA-JPCW-4WR7-C3VQ: GHSA-JPCW-4WR7-C3VQ: Remote Denial of Service via NULL Pointer Dereference in kin-openapi Parameter Validation\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-07-24\n> **Full Report:** https://cvereports.com/reports/GHSA-JPCW-4WR7-C3VQ\n\n## Summary\nA NULL pointer dereference vulnerability was discovered in the getkin/kin-openapi Go library. When parsing incoming request parameters that are validated against a content map with an empty media type, the openapi3filter request validation engine attempts to resolve an uninitialized schema pointer. This results in an unhandled Go runtime panic and process termination, yielding an unauthenticated, remote Denial of Service vector.\n\n## TL;DR\nUnauthenticated remote attackers can crash Go web servers using the kin-openapi validation middleware by sending a request containing a parameter whose media type has no defined schema, triggering a fatal NULL pointer dereference.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **Vulnerability ID**: GHSA-JPCW-4WR7-C3VQ\n- **CWE ID**: CWE-476 (Null Pointer Dereference)\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 7.5 (High)\n- **Exploit Status**: Proof of Concept (PoC) public\n- **CISA KEV Status**: Not Listed\n- **Impact**: Denial of Service (DoS)\n\n## Affected Systems\n\n- getkin/kin-openapi Go library and dependent API gateways/microservices\n- **kin-openapi**: < v0.144.0 (Fixed in: `v0.144.0`)\n\n## Mitigation\n\n- Upgrade kin-openapi dependency to version v0.144.0 or newer\n- Verify and audit OpenAPI schema files for parameter content objects without a schema\n- Implement Go runtime panic recovery middleware on HTTP handlers\n\n**Remediation Steps:**\n1. Run 'go get github.com/getkin/kin-openapi@v0.144.0' in the project root\n2. Run 'go mod tidy' to update the module dependencies\n3. Audit raw specification documents for query, header, or cookie parameters specifying content content maps without nested schema declarations\n4. Implement a central recovery block to ensure service survivability\n\n## References\n\n- [GitHub Security Advisory GHSA-JPCW-4WR7-C3VQ](https://github.com/advisories/GHSA-JPCW-4WR7-C3VQ)\n- [Fix Commit in kin-openapi](https://github.com/getkin/kin-openapi/commit/68ac2affa325514d7d6e731204d6a1edf6bdff64)\n- [v0.144.0 Release Notes](https://github.com/getkin/kin-openapi/releases/tag/v0.144.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-JPCW-4WR7-C3VQ) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-25T01:39:15.120197Z"} https://vulnerability.circl.lu/sighting/20279e3a-9438-409c-b03a-fa315d67cb54/export Sat, 25 Jul 2026 01:39:15 +0000