Description
kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.143.0, openapi3filter accepts OpenAPI 3.1 array schemas without an items keyword and then dereferences the nil Schema.Items value while decoding application/x-www-form-urlencoded or multipart/form-data request bodies, response headers, and other array parameter surfaces. A remote unauthenticated client can reach an affected operation with a nonempty request or matching response and deterministically trigger a nil-pointer panic during ValidateRequest or ValidateResponse. OpenAPI 3.0 documents are not affected because document validation rejects arrays without items, and JSON request bodies use a different decoder path. This issue is fixed in version 0.143.0.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
getkin kin-openapi
>= 0.136.0, < 0.143.0affected
References
- https://github.com/getkin/kin-openapi/security/advisories/GHSA-p6wj-qrr4-pgh5 ↗
- https://github.com/getkin/kin-openapi/commit/30e292371a89ca6d1f91a9553e0aa518b49f838d ↗
- https://github.com/getkin/kin-openapi/releases/tag/v0.143.0 ↗
- https://github.com/opnsense/core/security/advisories/GHSA-26cj-h9rj-g5pf ↗