CVE-2026-77354

Received Received - Intake

Memory Exhaustion via DeepObject Query in kin-openapi

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description

kin-openapi is a Go project for handling OpenAPI files. From 0.124.0 until 0.142.0, openapi3filter.sliceMapToSlice in openapi3filter/req_resp_decoder.go converts attacker-controlled sparse indexes from a deepObject query parameter into a dense slice by allocating entries from zero through the largest supplied index, after which buildResObj creates another slice of the same length. This allocation occurs before schema validation, so maxItems does not prevent it. An unauthenticated client can send a small query such as param[items][50000000]=x to an endpoint whose deepObject schema contains an array, forcing multi-gigabyte heap allocation and causing an OOM kill or restart loop. Other request-body encodings and styled parameters that do not produce bracketed integer indexes are not affected. This issue is fixed in version 0.142.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-21

Last Modified

2026-08-21

Generated

2026-08-22

AI Q&A

2026-08-22

EPSS Evaluated

N/A

NVD

CVE-2026-77354

EUVD

EUVD-2026-64151

Affected Vendors & Products

Vendor	Product	Version / Range
kin-openapi	kin-openapi	From 0.124.0 (inc) to 0.142.0 (inc)
kin-openapi	kin-openapi	0.142.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-789	The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability affects the kin-openapi Go project for handling OpenAPI files. It involves a flaw in openapi3filter.sliceMapToSlice where attacker-controlled sparse indexes from a deepObject query parameter cause excessive memory allocation. Before schema validation, the function allocates entries from zero through the largest supplied index, leading to multi-gigabyte heap allocation when an unauthenticated client sends a crafted query like param[items][50000000]=x.

Detection Guidance

This vulnerability can be detected by monitoring for unusually large memory allocations or OOM (Out of Memory) events triggered by requests with deepObject query parameters containing sparse indexes. Check server logs for requests with patterns like param[items][50000000]=x or similar bracketed integer indexes.

Impact Analysis

An attacker could exploit this to cause a denial of service by forcing the application to allocate excessive memory, potentially leading to an out-of-memory (OOM) kill or restart loop. This disrupts service availability for all users.

Mitigation Strategies

Immediately upgrade kin-openapi to version 0.142.0 or later. If upgrading is not possible, disable or restrict endpoints using deepObject query parameters until patched. Implement rate limiting and request size limits to prevent large allocations.

Hi! I’m here to help you understand CVE-2026-77354. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70