CVE-2026-76905
kin-openapi openai3filter: nil-pointer panic in ConvertErrors on malformed multipart/form-data body enables unauthenticated DoS
Description
kin-openapi is a Go project for handling OpenAPI files. From 0.10.0 until 0.141.0, openapi3filter.convertParseError in openapi3filter/validation_error_encoder.go dereferences e.Parameter.In without checking whether e.Parameter is nil. A malformed non-string scalar field in a multipart/form-data request body produces a nested ParseError with a nil RequestError.Parameter, and applications that render the validation error through openapi3filter.ConvertErrors or ValidationErrorEncoder panic. An unauthenticated client can repeatedly send such requests to deny service when the application lacks a recovery boundary. JSON request bodies and applications that do not use these error-rendering helpers are not affected. This issue is fixed in version 0.141.0.
INFO
Published Date :
Aug. 21, 2026, 9:17 p.m.
Last Modified :
Oct. 12, 2026, 4:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
Affected Products
The following products are affected by CVE-2026-76905
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | HIGH | [email protected] | ||||
| CVSS 3.1 | HIGH | MITRE-CVE |
Solution
- Update kin-openapi to version 0.141.0 or later.
- Ensure proper error handling for malformed requests.
- Implement request validation to prevent denial of service.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-76905.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-76905 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-76905
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-76905 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-76905 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 12, 2026
Action Type Old Value New Value Added Translation Title: kin-openapi de getkin, Description: kin-openapi es un proyecto Go para manejar archivos OpenAPI. Desde la versión 0.10.0 hasta la 0.141.0, openapi3filter.convertParseError en openapi3filter/validation_error_encoder.go desreferencia e.Parameter.In sin verificar si e.Parameter es nulo. Un campo escalar no-cadena malformado en un cuerpo de solicitud multipart/form-data produce un ParseError anidado con un RequestError.Parameter nulo, y las aplicaciones que renderizan el error de validación a través de openapi3filter.ConvertErrors o ValidationErrorEncoder entran en pánico. Un cliente no autenticado puede enviar repetidamente tales solicitudes para denegar el servicio cuando la aplicación carece de un límite de recuperación. Los cuerpos de solicitud JSON y las aplicaciones que no utilizan estas ayudas de renderizado de errores no se ven afectados. Este problema está corregido en la versión 0.141.0. -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Aug. 25, 2026
Action Type Old Value New Value Added Reference https://github.com/getkin/kin-openapi/security/advisories/GHSA-mmfr-pmjx-hw9w Added SSVC {'id': 'CVE-2026-76905', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'yes'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-08-25T14:21:31.513270Z'} -
New CVE Received by [email protected]
Aug. 21, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'getkin', 'product': 'kin-openapi', 'versions': [{'status': 'affected', 'version': '>= 0.10.0, < 0.141.0'}]}] Added Description kin-openapi is a Go project for handling OpenAPI files. From 0.10.0 until 0.141.0, openapi3filter.convertParseError in openapi3filter/validation_error_encoder.go dereferences e.Parameter.In without checking whether e.Parameter is nil. A malformed non-string scalar field in a multipart/form-data request body produces a nested ParseError with a nil RequestError.Parameter, and applications that render the validation error through openapi3filter.ConvertErrors or ValidationErrorEncoder panic. An unauthenticated client can repeatedly send such requests to deny service when the application lacks a recovery boundary. JSON request bodies and applications that do not use these error-rendering helpers are not affected. This issue is fixed in version 0.141.0. Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Added CWE CWE-476 Added Reference https://github.com/getkin/kin-openapi/commit/1d0a337c9b1570fab283be8a04c8af6e43b9a22c Added Reference https://github.com/getkin/kin-openapi/releases/tag/v0.141.0 Added Reference https://github.com/getkin/kin-openapi/security/advisories/GHSA-mmfr-pmjx-hw9w