CVE-2026-76905

Received Received - Intake

Panic in kin-openapi from nil Parameter dereference

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description

kin-openapi is a Go project for handling OpenAPI files. From 0.10.0 until 0.141.0, openapi3filter.convertParseError in openapi3filter/validation_error_encoder.go dereferences e.Parameter.In without checking whether e.Parameter is nil. A malformed non-string scalar field in a multipart/form-data request body produces a nested ParseError with a nil RequestError.Parameter, and applications that render the validation error through openapi3filter.ConvertErrors or ValidationErrorEncoder panic. An unauthenticated client can repeatedly send such requests to deny service when the application lacks a recovery boundary. JSON request bodies and applications that do not use these error-rendering helpers are not affected. This issue is fixed in version 0.141.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-21

Last Modified

2026-08-21

Generated

2026-08-22

AI Q&A

2026-08-22

EPSS Evaluated

N/A

NVD

CVE-2026-76905

EUVD

EUVD-2026-64150

Affected Vendors & Products

Vendor	Product	Version / Range
kin-openapi	openapi3filter	to 0.141.0 (inc)
kin-openapi	openapi3filter	0.141.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

This vulnerability affects the kin-openapi Go project for handling OpenAPI files. It occurs when openapi3filter.convertParseError dereferences e.Parameter.In without checking if e.Parameter is nil. A malformed non-string scalar field in a multipart/form-data request body causes a nested ParseError with a nil RequestError.Parameter, leading to a panic when validation errors are rendered through openapi3filter.ConvertErrors or ValidationErrorEncoder. This can cause denial of service as unauthenticated clients send such requests repeatedly.

Detection Guidance

The vulnerability can be detected by checking the version of kin-openapi in use. If your system runs a version between 0.10.0 and 0.141.0, it is vulnerable. Commands like 'go list -m github.com/getkin/kin-openapi' can help identify the installed version.

Impact Analysis

If you use kin-openapi versions 0.10.0 to 0.141.0, an attacker could send specially crafted requests to crash your application. This leads to service disruption and potential downtime. Applications not using the affected error-rendering helpers or JSON request bodies are not impacted.

Mitigation Strategies

Upgrade kin-openapi to version 0.141.0 or later immediately. If upgrading is not possible, disable error rendering through openapi3filter.ConvertErrors or ValidationErrorEncoder until the upgrade is completed.

Hi! I’m here to help you understand CVE-2026-76905. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70