DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-77354: CVE-2026-77354: Uncontrolled Resource Consumption (OOM) via Sparse Array Indexes in kin-openapi

#security #cve #cybersecurity

CVE-2026-77354: Uncontrolled Resource Consumption (OOM) via Sparse Array Indexes in kin-openapi

Vulnerability ID: CVE-2026-77354
CVSS Score: 8.7
Published: 2026-08-21

An uncontrolled resource consumption vulnerability (CWE-400/CWE-789) exists within the kin-openapi Go library prior to version 0.142.0. The vulnerability occurs during the processing of highly sparse array indexes inside query parameters defined in deepObject style. An unauthenticated remote attacker can exploit this flaw to cause an immediate Out-of-Memory (OOM) crash of the target application.

TL;DR

An unauthenticated remote attacker can crash Go services using kin-openapi (openapi3filter) by passing a highly sparse array index in a deepObject query parameter, causing massive memory allocations before validation takes place.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-400, CWE-789
  • Attack Vector: Network
  • CVSS v4.0 Score: 8.7 (High)
  • EPSS Score: Not Available
  • Impact: Denial of Service (OOM Process Crash)
  • Exploit Status: Proof-of-Concept
  • KEV Status: Not Listed

Affected Systems

  • Go applications implementing github.com/getkin/kin-openapi/openapi3filter
  • kin-openapi: >= 0.124.0, < 0.142.0 (Fixed in: 0.142.0)

Code Analysis

Commit: 1223a0f

openapi3filter: fix OOM vulnerability when parsing extremely sparse array in deepObject parameter

const maxSliceMapToSliceGap = 10000; if gap := max + 1 - len(m); gap > maxSliceMapToSliceGap { return nil, fmt.Errorf(...) }
Enter fullscreen mode Exit fullscreen mode

Mitigation Strategies

  • Upgrade github.com/getkin/kin-openapi dependency to version 0.142.0 or higher.
  • Deploy WAF filter rules to intercept and inspect query parameter patterns containing large index values.
  • Implement aggressive container resource limits to contain the impact of Out-Of-Memory crashes.

Remediation Steps:

  1. Identify all internal Go projects referencing 'github.com/getkin/kin-openapi'.
  2. Modify go.mod files to point to 'github.com/getkin/kin-openapi v0.142.0' or later.
  3. Run 'go mod tidy' to update dependency trees and rebuild services.
  4. Verify the application handles parameters correctly by verifying test inputs with sparse arrays are rejected.

References

Read the full report for CVE-2026-77354 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)