CVE-2026-77354: kin-openapi Denial of Service Vulnerability

CVE-2026-77354 Overview

CVE-2026-77354 is a resource exhaustion vulnerability [CWE-400] in kin-openapi, a Go library for parsing and validating OpenAPI files. The flaw exists in openapi3filter.sliceMapToSlice within openapi3filter/req_resp_decoder.go. The function converts attacker-controlled sparse indexes from a deepObject query parameter into a dense slice by allocating entries from zero through the largest supplied index. Allocation occurs before schema validation, so the maxItems constraint offers no protection. Affected versions range from 0.124.0 through 0.141.x, and version 0.142.0 contains the fix.

Critical Impact
An unauthenticated attacker can trigger multi-gigabyte heap allocation with a single small HTTP request, causing an out-of-memory kill or service restart loop.

Affected Products

kin-openapi versions 0.124.0 through 0.141.x
Go services using openapi3filter with deepObject array parameters
APIs relying on kin-openapi for request validation

Discovery Timeline

2026-08-21 - CVE-2026-77354 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-77354

Vulnerability Analysis

The vulnerability affects request decoding for OpenAPI parameters using the deepObject style. When a query parameter targets an array schema, sliceMapToSlice receives a map keyed by string indexes. The function determines the largest numeric key and allocates a slice sized to that key plus one. A subsequent call to buildResObj allocates a second slice of identical length. Because both allocations execute before schema validation, maxItems cannot bound the resulting memory footprint. The result is a Denial of Service via memory exhaustion in the Go runtime.

Root Cause

The root cause is trust of attacker-supplied array indexes during input decoding. sliceMapToSlice treats each bracketed integer index as an authoritative size hint rather than as untrusted input requiring validation. Two dense slices are allocated proportional to the maximum index, not to the number of provided elements. Sparse index handling should either cap the gap between provided elements or defer allocation until schema validation completes.

Attack Vector

The attack requires no authentication and executes over the network. An attacker sends a crafted query string such as param[items][50000000]=x to any endpoint whose OpenAPI specification defines a deepObject parameter containing an array. Each request forces the target process to allocate hundreds of megabytes to multiple gigabytes of heap. Repeated requests trigger OOM kills, container restarts, or degraded service across the cluster. Request-body encodings and styled parameters that do not produce bracketed integer indexes are not affected.

 	return result, nil
 }
 
+// maxSliceMapToSliceGap bounds how many synthesized nil holes sliceMapToSlice
+// will fill in for a sparse array before rejecting the input. Without this,
+// an attacker-supplied index (e.g. from a deepObject query parameter) drives
+// an allocation proportional to the index itself, regardless of how many
+// elements were actually provided.
+const maxSliceMapToSliceGap = 10000
+
 // example: map[0:map[key:true] 1:map[key:false]] -> [map[key:true] map[key:false]]
 func sliceMapToSlice(m map[string]any) ([]any, error) {
 	var result []any

Source: GitHub Commit 1223a0f. The patch introduces a maxSliceMapToSliceGap constant of 10000 that bounds synthesized nil holes and rejects sparse arrays exceeding the gap.

Detection Methods for CVE-2026-77354

Indicators of Compromise

Query strings containing bracketed numeric indexes with large values, for example param[key][10000000]= or param[items][99999999]=.
Sudden spikes in Go runtime heap size or runtime.MemStats.HeapAlloc correlated with inbound API traffic.
Container or pod restarts with OOMKilled status shortly after receiving requests to endpoints using deepObject array parameters.
HTTP 5xx responses or connection resets from services embedding vulnerable kin-openapi versions.

Detection Strategies

Inspect access logs and web application firewall telemetry for query parameters containing bracketed indexes exceeding a reasonable threshold, such as 10000.
Perform software composition analysis on Go build artifacts and go.sum files to identify github.com/getkin/kin-openapi versions between 0.124.0 and 0.141.x.
Correlate memory pressure events with request patterns targeting endpoints defined with deepObject style parameters.

Monitoring Recommendations

Alert on repeated OOM kills or restart loops in services that expose OpenAPI-validated endpoints.
Track request rate and payload characteristics for endpoints known to accept deepObject array inputs.
Ingest process, container, and API gateway telemetry into a centralized data lake for cross-signal correlation.

How to Mitigate CVE-2026-77354

Immediate Actions Required

Upgrade github.com/getkin/kin-openapi to version 0.142.0 or later in all Go services and rebuild affected binaries.
Audit OpenAPI specifications for parameters declared with style: deepObject and type: array, and prioritize those endpoints for patching.
Deploy WAF or reverse-proxy rules that reject query parameters with bracketed integer indexes above a conservative bound.

Patch Information

The fix is included in GitHub Release v0.142.0 and applied in Pull Request #923. Full advisory details are available in GHSA-xhj3-7xw9-vr34. Update the module with go get github.com/getkin/kin-openapi@v0.142.0 and verify with go list -m all.

Workarounds

Reject inbound requests at the gateway when query strings contain bracketed indexes larger than the expected maxItems for that parameter.
Temporarily remove deepObject array parameters from the OpenAPI specification and require alternative encodings such as JSON request bodies.
Apply Go runtime memory limits with GOMEMLIMIT and container memory caps to reduce blast radius until the upgrade is deployed.

bash

# Configuration example
go get github.com/getkin/kin-openapi@v0.142.0
go mod tidy
go build ./...

# Verify the installed version
go list -m github.com/getkin/kin-openapi