CVE-2026-77354

Name of the Vulnerable Software and Affected Versions kin-openapi versions 0.124.0 through 0.141.0

Description An unauthenticated client can trigger a denial of service by sending a query with sparse indexes in a deepObject query parameter to an endpoint whose schema contains an array. The function sliceMapToSlice() in openapi3filter/req resp decoder.go converts these indexes into a dense slice by allocating entries from zero up to the largest supplied index, and subsequently, buildResObj() creates another slice of the same length. Because this allocation happens before schema validation, the maxItems constraint is bypassed, potentially forcing multi-gigabyte heap allocations that lead to an Out-of-Memory (OOM) kill or a restart loop. Request-body encodings and styled parameters that do not use bracketed integer indexes are not affected.

Recommendations Update to version 0.142.0.