GHSA-JPCW-4WR7-C3VQ: GHSA-JPCW-4WR7-C3VQ: Remote Denial of Service via NULL Pointer Dereference in kin-openapi Parameter Validation

#security #cve #cybersecurity #ghsa

GHSA-JPCW-4WR7-C3VQ: Remote Denial of Service via NULL Pointer Dereference in kin-openapi Parameter Validation

Vulnerability ID: GHSA-JPCW-4WR7-C3VQ
CVSS Score: 7.5
Published: 2026-07-24

A NULL pointer dereference vulnerability was discovered in the getkin/kin-openapi Go library. When parsing incoming request parameters that are validated against a content map with an empty media type, the openapi3filter request validation engine attempts to resolve an uninitialized schema pointer. This results in an unhandled Go runtime panic and process termination, yielding an unauthenticated, remote Denial of Service vector.

TL;DR

Unauthenticated remote attackers can crash Go web servers using the kin-openapi validation middleware by sending a request containing a parameter whose media type has no defined schema, triggering a fatal NULL pointer dereference.

⚠️ Exploit Status: POC

Technical Details

Vulnerability ID: GHSA-JPCW-4WR7-C3VQ
CWE ID: CWE-476 (Null Pointer Dereference)
Attack Vector: Network
CVSS v3.1 Score: 7.5 (High)
Exploit Status: Proof of Concept (PoC) public
CISA KEV Status: Not Listed
Impact: Denial of Service (DoS)

Affected Systems

getkin/kin-openapi Go library and dependent API gateways/microservices
kin-openapi: < v0.144.0 (Fixed in: v0.144.0)

Code Analysis

Commit: 68ac2af

Fix openapi3filter parameter content panic when schema is omitted

diff --git a/openapi3filter/req_resp_decoder.go b/openapi3filter/req_resp_decoder.go
index 1234567..89abcde 100644
--- a/openapi3filter/req_resp_decoder.go
+++ b/openapi3filter/req_resp_decoder.go
@@ -194,6 +194,10 @@ func defaultContentParameterDecoder(param *openapi3.Parameter, values []string)
        err = fmt.Errorf("parameter %q has no content schema", param.Name)
        return
    }
+   if mt.Schema == nil {
+       err = fmt.Errorf("parameter %q content media type has no schema", param.Name)
+       return
+   }
    outSchema = mt.Schema.Value

    unmarshal := func(encoded string, paramSchema *openapi3.SchemaRef) (decoded any, err error) {

Mitigation Strategies

Upgrade kin-openapi dependency to version v0.144.0 or newer
Verify and audit OpenAPI schema files for parameter content objects without a schema
Implement Go runtime panic recovery middleware on HTTP handlers

Remediation Steps:

Run 'go get github.com/getkin/kin-openapi@v0.144.0' in the project root
Run 'go mod tidy' to update the module dependencies
Audit raw specification documents for query, header, or cookie parameters specifying content content maps without nested schema declarations
Implement a central recovery block to ensure service survivability

References

Read the full report for GHSA-JPCW-4WR7-C3VQ on our website for more details including interactive diagrams and full exploit analysis.

DEV Community