CVE-2026-73502

Name of the Vulnerable Software and Affected Versions kin-openapi versions 0.2.0 through 0.143.0

Description An unauthenticated remote denial of service exists when the openapi3filter.ValidateRequest function processes an operation that declares a content parameter where the application/json media type lacks a schema. The defaultContentParameterDecoder function in openapi3filter/req resp decoder.go dereferences mt.Schema.Value without verifying if mt.Schema is nil. This occurs even though the document is considered legal under OpenAPI 3.0.x and 3.1.x specifications. A single unauthenticated request can trigger a panic, leading to an aborted request and log growth in synchronous net/http paths, or a complete process crash in integrations without recovery mechanisms or non-net/http hosts.

Recommendations Update kin-openapi to version 0.144.0. As a temporary workaround, ensure every content parameter in served specifications declares a schema or reject such specifications at load time. As a temporary workaround, supply a custom ParamDecoder that guards against mt.Schema == nil. As a temporary workaround, run request validation inside a handler with an explicit recover() function.