CVE-2026-76905: CVE-2026-76905: Denial of Service via Nil-Pointer Dereference in getkin/kin-openapi openapi3filter

#security #cve #cybersecurity

CVE-2026-76905: Denial of Service via Nil-Pointer Dereference in getkin/kin-openapi openapi3filter

Vulnerability ID: CVE-2026-76905
CVSS Score: 7.5
Published: 2026-08-21

CVE-2026-76905 is a high-severity Denial of Service (DoS) vulnerability in the getkin/kin-openapi library, specifically inside the openapi3filter sub-package. When processing multipart/form-data request validation errors, a missing nil-pointer guard causes a Go runtime panic during error formatting. This panic terminates the active server process if no recovery handler is present, resulting in a total denial of service. The vulnerability affects versions from v0.10.0 to v0.140.0, and is resolved in v0.141.0.

TL;DR

Unauthenticated remote attackers can crash servers using getkin/kin-openapi (v0.10.0 to v0.140.0) by transmitting a malformed multipart/form-data request, triggering a nil-pointer dereference panic in the error validation encoder.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-476
Attack Vector: Network
CVSS Score: 7.5
EPSS Percentile: N/A
Impact: Denial of Service (DoS)
Exploit Status: Proof-of-Concept
KEV Status: Not Listed

Affected Systems

Go applications using getkin/kin-openapi in combination with openapi3filter validation handlers.
github.com/getkin/kin-openapi: >= 0.10.0, < 0.141.0 (Fixed in: v0.141.0)

Code Analysis

Commit: 1d0a337

Fix a nil-pointer dereference in convertParseError

@@ -117,16 +117,24 @@ func convertParseError(e *RequestError, innerErr *ParseError) *ValidationError {
        }
    } else if innerErr.RootCause() != nil {
        if rootErr, ok := innerErr.Cause.(*ParseError); ok &&
-           rootErr.Kind == KindInvalidFormat && e.Parameter.In == "query" {
+           rootErr.Kind == KindInvalidFormat && e.Parameter != nil && e.Parameter.In == "query" {
            return &ValidationError{
                Status: http.StatusBadRequest,
                Title: fmt.Sprintf("parameter %q in %s is invalid: %v is %s",
                    e.Parameter.Name, e.Parameter.In, rootErr.Value, rootErr.Reason),
            }
        }
+       title := innerErr.Reason
+       if title == "" {
+           title = innerErr.Error()
+       }
        return &ValidationError{
            Status: http.StatusBadRequest,
-           Title:  innerErr.Reason,
+           Title:  title,
        }
    }
    return nil

Exploit Details

GitHub: Regression test suite illustrating the crash vectors during request validation.

Mitigation Strategies

Upgrade to getkin/kin-openapi v0.141.0 or newer.
Deploy a panic recovery middleware helper at the HTTP handler layer to isolate and catch runtime panics.
Formulate client-side error responses using custom formatting wrappers that bypass the vulnerable ConvertErrors API.

Remediation Steps:

Open the active project directory containing the vulnerable go.mod file.
Update the dependency to the patched version: go get github.com/getkin/kin-openapi@v0.141.0
Verify and clean the dependency tree using: go mod tidy
Verify the installation of panic-recovery middleware configurations at the root router level to guarantee fallback resilience.
Recompile and redeploy the patched binaries to production environments.

References

Read the full report for CVE-2026-76905 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community