CVE-2026-76905: kin-openapi DOS Vulnerability

CVE-2026-76905 Overview

CVE-2026-76905 is a null pointer dereference vulnerability in kin-openapi, a Go library for parsing and validating OpenAPI files. The flaw resides in openapi3filter.convertParseError within openapi3filter/validation_error_encoder.go. The function dereferences e.Parameter.In without checking whether e.Parameter is nil. Versions from 0.10.0 through 0.140.x are affected, and the issue is fixed in 0.141.0. An unauthenticated remote attacker can send crafted multipart/form-data requests to trigger a panic in applications that render validation errors through openapi3filter.ConvertErrors or ValidationErrorEncoder, resulting in denial of service [CWE-476].

Critical Impact
Unauthenticated attackers can repeatedly crash Go services using kin-openapi versions 0.10.0 to 0.140.x by sending malformed multipart request bodies.

Affected Products

kin-openapi versions 0.10.0 through 0.140.x
Go applications using openapi3filter.ConvertErrors for error rendering
Go applications using openapi3filter.ValidationErrorEncoder for validation responses

Discovery Timeline

2026-08-21 - CVE-2026-76905 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-76905

Vulnerability Analysis

The vulnerability affects the request validation error encoding path in kin-openapi. When a client submits a multipart/form-data request containing a malformed non-string scalar field, the multipart decoder produces a nested ParseError whose enclosing RequestError.Parameter field is nil. The outer convertParseError handler assumes e.Parameter is always populated and reads e.Parameter.In directly. That direct dereference panics the goroutine handling the HTTP request.

Applications lacking a recover() boundary around request handling terminate the request goroutine and, depending on server architecture, may cascade into wider service disruption. Repeated requests amplify the impact into a sustained denial-of-service condition. JSON request bodies and applications that do not invoke ConvertErrors or ValidationErrorEncoder are not affected.

Root Cause

The root cause is a missing nil check on e.Parameter before accessing its In field. Body-level parse errors legitimately produce a nested ParseError with no associated Parameter, but the encoder path was written under the assumption that parameter context is always attached to the error.

Attack Vector

An unauthenticated remote attacker sends an HTTP request with a multipart/form-data body containing a scalar field (for example, an integer or boolean) whose value fails type parsing. The kin-openapi middleware constructs a nested ParseError, the encoder dereferences the missing Parameter, and the handling goroutine panics. The following patch from the upstream commit shows the introduced nil check and fallback title handling:

		}
	} else if innerErr.RootCause() != nil {
		if rootErr, ok := innerErr.Cause.(*ParseError); ok &&
-			rootErr.Kind == KindInvalidFormat && e.Parameter.In == "query" {
+			rootErr.Kind == KindInvalidFormat && e.Parameter != nil && e.Parameter.In == "query" {
			return &ValidationError{
				Status: http.StatusBadRequest,
				Title: fmt.Sprintf("parameter %q in %s is invalid: %v is %s",
					e.Parameter.Name, e.Parameter.In, rootErr.Value, rootErr.Reason),
			}
		}
+		// For body parse errors (e.Parameter == nil) the outer ParseError's
+		// Reason is often empty, e.g. the multipart decoder wraps a part's
+		// *ParseError without setting one. Fall back to the full error text so
+		// the response still carries a meaningful message.
+		title := innerErr.Reason
+		if title == "" {
+			title = innerErr.Error()
+		}
		return &ValidationError{
			Status: http.StatusBadRequest,
-			Title:  innerErr.Reason,
+			Title:  title,
		}
	}
	return nil

Source: GitHub Commit 1d0a337

Detection Methods for CVE-2026-76905

Indicators of Compromise

Repeated multipart/form-data requests from a single source followed by application panic logs referencing openapi3filter/validation_error_encoder.go.
Go runtime stack traces containing runtime error: invalid memory address or nil pointer dereference originating in convertParseError.
Sudden spikes in HTTP 5xx responses correlated with malformed multipart payloads.

Detection Strategies

Inventory Go build dependencies and flag any project importing github.com/getkin/kin-openapi at versions below 0.141.0.
Inspect application logs for panic traces referencing openapi3filter.ConvertErrors or ValidationErrorEncoder.
Deploy web application firewall rules to identify malformed non-string scalar fields inside multipart/form-data bodies.

Monitoring Recommendations

Monitor process restart counts and goroutine panic metrics on services exposing OpenAPI-validated endpoints.
Alert on elevated request rates hitting endpoints that accept multipart bodies.
Track error rates per client IP to identify sustained abuse patterns targeting parse-error paths.

How to Mitigate CVE-2026-76905

Immediate Actions Required

Upgrade github.com/getkin/kin-openapi to version 0.141.0 or later across all Go services.
Rebuild and redeploy any downstream binaries that vendor or transitively depend on the affected library.
Add a recover() middleware to HTTP handlers as a defense-in-depth measure against future panic-based denial of service.

Patch Information

The fix is included in kin-openapi v0.141.0. The upstream commit adds a nil check on e.Parameter before dereferencing e.Parameter.In and provides a fallback title for body-level parse errors. Full advisory details are available in GHSA-mmfr-pmjx-hw9w.

Workarounds

Wrap HTTP request handlers with a panic-recovery middleware that returns HTTP 500 without terminating the goroutine chain.
Restrict acceptance of multipart/form-data request bodies on endpoints that do not require them.
Deploy a reverse proxy or WAF rule to reject multipart requests containing non-string scalar values that violate the declared OpenAPI schema.

bash

# Update the Go module dependency to the patched release
go get github.com/getkin/kin-openapi@v0.141.0
go mod tidy
go build ./...