CVE-2026-73502: kin-openapi NULL Pointer DoS Vulnerability

CVE-2026-73502 Overview

CVE-2026-73502 is a NULL pointer dereference vulnerability [CWE-476] in kin-openapi, a Go library for handling OpenAPI files. The flaw affects versions 0.2.0 through 0.143.x and is fixed in 0.144.0. The openapi3filter.ValidateRequest function panics when an operation declares a content parameter whose application/json media type has no schema. A single unauthenticated HTTP request can trigger the panic, aborting request validation and, depending on integration, crashing the host process.

Critical Impact
An unauthenticated remote attacker can send one crafted request to abort validation, generate excessive log growth, or crash processes that lack panic recovery middleware.

Affected Products

github.com/getkin/kin-openapi versions 0.2.0 through 0.143.x
Go services using openapi3filter.ValidateRequest for request validation
Integrations without net/http panic recovery around validation

Discovery Timeline

2026-08-18 - CVE-2026-73502 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-73502

Vulnerability Analysis

The vulnerability resides in openapi3filter/req_resp_decoder.go within the defaultContentParameterDecoder routine. The decoder dereferences mt.Schema.Value without first checking whether mt.Schema is nil. Because doc.Validate() accepts OpenAPI 3.0.x and 3.1.x documents where a media type entry omits schema, this input is reachable through normal specification loading.

When the decoder encounters such a parameter during request validation, the nil dereference triggers a Go runtime panic. In the common synchronous net/http request path, the panic aborts the current request and is written to the server log, producing log growth under repeated requests. In integrations that do not install a recover() handler around the validator, the panic propagates and crashes the entire process, producing a denial-of-service condition.

Root Cause

The root cause is missing nil-checking on the mt.Schema field before value access. The parser treated the outer mt (media type) as sufficient validation, but the OpenAPI specifications permit a media type object with no schema field, leaving mt.Schema as a valid nil.

Attack Vector

Exploitation requires an unauthenticated network request against any endpoint documented with a content parameter whose media type omits schema. No authentication, user interaction, or special privileges are required. The attacker only needs to send a single HTTP request that reaches the vulnerable validator path.

// Security patch in openapi3filter/req_resp_decoder.go
		err = fmt.Errorf("parameter %q has no content schema", param.Name)
		return
	}
+	if mt.Schema == nil {
+		err = fmt.Errorf("parameter %q content media type has no schema", param.Name)
+		return
+	}
	outSchema = mt.Schema.Value

	unmarshal := func(encoded string, paramSchema *openapi3.SchemaRef) (decoded any, err error) {

Source: GitHub Commit 68ac2af

Detection Methods for CVE-2026-73502

Indicators of Compromise

Go runtime panic stack traces referencing openapi3filter/req_resp_decoder.go and defaultContentParameterDecoder in application logs.
Sudden spikes in HTTP 500 responses or aborted requests correlated with specific endpoints that use content parameters.
Unexpected process restarts of Go services that embed kin-openapi for request validation.

Detection Strategies

Audit go.mod and go.sum across services to flag github.com/getkin/kin-openapi versions earlier than 0.144.0.
Grep OpenAPI documents for content: blocks that lack a nested schema: key under application/json.
Add log-based alerts on panic signatures matching runtime error: invalid memory address or nil pointer dereference within request-validation frames.

Monitoring Recommendations

Monitor request-validation error rates and process restart counters on services exposing OpenAPI-defined endpoints.
Track log volume growth from validation code paths to detect exploitation attempts that generate repeated panics.
Alert on repeated identical requests from a single source targeting endpoints with parameter validation.

How to Mitigate CVE-2026-73502

Immediate Actions Required

Upgrade github.com/getkin/kin-openapi to version 0.144.0 or later in all Go services.
Rebuild and redeploy any service that transitively depends on the vulnerable module.
Ensure request handlers invoking openapi3filter.ValidateRequest are wrapped by recover() middleware until patched.

Patch Information

The fix is delivered in kin-openapi v0.144.0 via commit 68ac2af. The patch adds a nil check on mt.Schema and returns a descriptive error instead of dereferencing. Full advisory details are available in GHSA-jpcw-4wr7-c3vq.

Workarounds

Amend OpenAPI documents so every application/json media type under content parameters declares a schema field.
Wrap validator invocations with a defer recover() block that returns HTTP 400 on panic to prevent process crashes.
Place a schema-aware API gateway or WAF in front of affected services to reject requests hitting the vulnerable parameter path.

bash

# Upgrade to the patched release
go get github.com/getkin/kin-openapi@v0.144.0
go mod tidy
go build ./...