kin-openapi: Uncontrolled resource consumption in openapi3filter deepObject query parameter decoding
Priority HIGH 77CWE-400Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 7 fixed, 10 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.
Summary
kin-openapi is a Go project for handling OpenAPI files. From 0.124.0 until 0.142.0, openapi3filter.sliceMapToSlice in openapi3filter/req_resp_decoder.go converts attacker-controlled sparse indexes from a deepObject query parameter into a dense slice by allocating entries from zero through the largest supplied index, after which buildResObj creates another slice of the same length. This allocation occurs before schema validation, so maxItems does not prevent it. An unauthenticated client can send a small query such as param[items][50000000]=x to an endpoint whose deepObject schema contains an array, forcing multi-gigabyte heap allocation and causing an OOM kill or restart loop. Other request-body encodings and styled parameters that do not produce bracketed integer indexes are not affected. This issue is fixed in version 0.142.0.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00524 44th percentileScored 2026-11-07
Fix Partial kin-openapi (getkin): 0.142.0github.com/getkin/kin-openapi (Go): 0.142.0Red Hat: 8 advisoriesRed Hat: 7 fixed, 10 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| getkin | kin-openapi | 0.124.0 to before 0.142.0 | 0.142.0 | Patch available | CNA |
| — | github.com/getkin/kin-openapi (Go) | 0.124.0 to before 0.142.0 | 0.142.0 | Patch available | GHSA-xhj3-7xw9-vr34 |
- kin-openapi Vendorgetkin Affected 0.124.0 to before 0.142.0 Fixed in 0.142.0 Patch available CNA
- github.com/getkin/kin-openapi (Go) Vendor— Affected 0.124.0 to before 0.142.0 Fixed in 0.142.0 Patch available GHSA-xhj3-7xw9-vr34
Remediation
- Fix · CNA kin-openapi (getkin) Fixed in 0.142.0
- Fix · GHSA-xhj3-7xw9-vr34 github.com/getkin/kin-openapi (Go) Fixed in 0.142.0 Advisory →
Red Hat 8 advisories
- RHSA-2026:95517 Released 2026-11-05 · Red Hat rating ImportantMulticluster Global Hub 1.7.4 security update
- Multicluster Global Hub 1.7.4 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1
- RHSA-2026:94612 Released 2026-11-03 · Red Hat rating ImportantRed Hat Edge Manager Version 1.2.2 Security Update
- Red Hat Edge Manager 1.2 registry.redhat.io/rhem/flightctl-alert-exporter-rhel10, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10, registry.redhat.io/rhem/flightctl-api-rhel10 +11
- RHSA-2026:94608 Released 2026-11-03 · Red Hat rating ImportantRed Hat Edge Manager Version 1.2.2 Security Update
- Red Hat Edge Manager 1.2 registry.redhat.io/rhem/flightctl-alert-exporter-rhel9, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel9, registry.redhat.io/rhem/flightctl-api-rhel9 +11
Show 5 more Red Hat advisories
- RHSA-2026:92307 Released 2026-10-29 · Red Hat rating ImportantRed Hat Advanced Cluster Management for Kubernetes v2.13.14 security update
- Red Hat Advanced Cluster Management for Kubernetes 2.13 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9 +16
- RHSA-2026:87410 Released 2026-10-21 · Red Hat rating CriticalRHOAI 2.25.12 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-codeflare-operator-rhel9 +47
- RHSA-2026:86891 Released 2026-10-21 · Red Hat rating CriticalRHOAI 3.5.2 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.5 registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-cli-rhel9 +47
- RHSA-2026:84734 Released 2026-10-19 · Red Hat rating CriticalRHOAI 3.4.5 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
- RHSA-2026:82315 Released 2026-10-13 · Red Hat rating ImportantMigration Toolkit for Applications
- Red Hat Migration Toolkit for Applications 8.2 registry.redhat.io/mta/mta-cli-rhel9, registry.redhat.io/mta/mta-hub-rhel9
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Serverless | Affected | No fix yet |
| Red Hat Ceph Storage 6 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 7 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 8 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 9 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 5 | Affected | No fix yet |
| Red Hat OpenShift GitOps | Affected | No fix planned: Will not fix |
| Red Hat Service Interconnect 2 | Affected | No fix yet |
| Multicluster Global Hub 1.7.4 | Fixed | RHSA-2026:95517 |
| Red Hat Advanced Cluster Management for Kubernetes 2.13 | Fixed | RHSA-2026:92307 |
| Red Hat Edge Manager 1.2 | Fixed | RHSA-2026:94608, RHSA-2026:94612 |
| Red Hat Migration Toolkit for Applications 8.2 | Fixed | RHSA-2026:82315 |
| Red Hat OpenShift AI 2.25 | Fixed | RHSA-2026:87410 |
| Red Hat OpenShift AI 3.4 | Fixed | RHSA-2026:84734 |
| Red Hat OpenShift AI 3.5 | Fixed | RHSA-2026:86891 |
Not affected: 21 products
- Migration Toolkit for Applications 8
- Multicluster Engine for Kubernetes
- Multicluster Global Hub 1.7.4
- OpenShift Serverless
- Red Hat 3scale API Management Platform 2
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Advanced Cluster Management for Kubernetes 2.13
- Red Hat Ceph Storage 5
- Red Hat Edge Manager 1
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Hardened Images
- Red Hat Migration Toolkit for Applications 8.2
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift AI 2.25
- Red Hat OpenShift AI 3.4
- Red Hat OpenShift AI 3.5
- Red Hat OpenShift Container Platform 4
- Red Hat OpenStack Platform 18.0
- Red Hat Service Interconnect 2
Timeline
- 2026-10-02 Threatist record created from CVE-2026-77354
- 2026-10-03 Alias added: GHSA-xhj3-7xw9-vr34
- 2026-10-14 Fix available: RHSA-2026:82315 · Red Hat
- 2026-10-15 Fix available: Red Hat Migration Toolkit for Applications 8.2 · Red Hat
- 2026-10-19 Affected versions changed · Red Hat
- 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
- 2026-10-20 Fix available: Red Hat OpenShift AI 3.4 · Red Hat
- 2026-10-22 Fix available: RHSA-2026:86891 · Red Hat
- 2026-10-22 Fix available: RHSA-2026:87410 · Red Hat
- 2026-10-23 Fix available: Red Hat OpenShift AI 2.25, Red Hat OpenShift AI 3.5 · Red Hat
- 2026-10-30 Fix available: RHSA-2026:92307 · Red Hat
- 2026-10-30 Fix available: Red Hat Advanced Cluster Management for Kubernetes 2.13 · Red Hat
- 2026-10-30 Affected versions changed · Red Hat
- 2026-11-04 Fix available: RHSA-2026:94612 · Red Hat
- 2026-11-04 Fix available: RHSA-2026:94608 · Red Hat
- 2026-11-04 Fix available: Red Hat Edge Manager 1.2 · Red Hat
- 2026-11-06 Fix available: Multicluster Global Hub 1.7.4 · Red Hat
- 2026-11-06 Fix available: RHSA-2026:95517 · Red Hat
References
Other 5
- https://github.com/getkin/kin-openapi/security/advisories/GHSA-xhj3-7xw9-vr34
- https://github.com/getkin/kin-openapi/pull/923
- https://github.com/getkin/kin-openapi/commit/1223a0f215d2cf9beb2d9eb9ea2649d001c21388
- https://github.com/getkin/kin-openapi/releases/tag/v0.142.0
- https://github.com/getkin/kin-openapi
More getkin vulnerabilities
- TI-2026-51613 kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default CVSS 3.1CRITICAL 9.1
- TI-2026-74664 Nil pointer panic in kin-openapi openapi3filter decoding CVSS 3.1HIGH 7.5
- TI-2026-74663 YAML NaN and Inf values cause panic in kin-openapi validation CVSS 3.1HIGH 7.5
- TI-2026-74661 kin-openapi nil pointer panic in openapi3filter on array schemas without items CVSS 3.1HIGH 7.5
- TI-2026-74657 Uncontrolled recursion in kin-openapi crashes the process CVSS 3.1HIGH 7.5
- TI-2026-53730 NULL pointer dereference in getkin kin-openapi CVSS 3.1HIGH 7.5
Sources
- CVE-2026-77354 · CVE Program
- CVE-2026-77354 · NVD
- FIRST EPSS
- GHSA-xhj3-7xw9-vr34 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-77354 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences