CVE-2026-76905

Name of the Vulnerable Software and Affected Versions kin-openapi versions 0.10.0 through 0.140.0

Description The openapi3filter.convertParseError function in openapi3filter/validation error encoder.go dereferences e.Parameter.In without verifying if e.Parameter is nil. When a multipart/form-data request body contains a malformed non-string scalar field, it generates a nested ParseError with a nil RequestError.Parameter. Applications utilizing openapi3filter.ConvertErrors or ValidationErrorEncoder to render these validation errors will experience a panic. An unauthenticated client can exploit this by sending repeated requests to cause a denial of service if the application does not implement a recovery boundary. JSON request bodies and applications that do not use these specific error-rendering helpers are not affected.

Recommendations Update kin-openapi to version 0.141.0.