CyberRota Analysis
AI-GeneratedThe kin-openapi library versions 0.10.0 to 0.141.0 are vulnerable to a denial-of-service attack due to improper handling of nil parameters in error responses, which can lead to application panics when processing malformed multipart/form-data requests. This vulnerability primarily affects applications that utilize the openapi3filter.ConvertErrors or ValidationErrorEncoder functions without adequate recovery mechanisms. Developers using these versions should prioritize upgrading to version 0.141.0 to mitigate potential service disruptions from unauthenticated attacks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
kin-openapi is a Go project for handling OpenAPI files. From 0.10.0 until 0.141.0, openapi3filter.convertParseError in openapi3filter/validation_error_encoder.go dereferences e.Parameter.In without checking whether e.Parameter is nil. A malformed non-string scalar field in a multipart/form-data request body produces a nested ParseError with a nil RequestError.Parameter, and applications that render the validation error through openapi3filter.ConvertErrors or ValidationErrorEncoder panic. An unauthenticated client can repeatedly send such requests to deny service when the application lacks a recovery boundary. JSON request bodies and applications that do not use these error-rendering helpers are not affected. This issue is fixed in version 0.141.0.