CVE-2026-73502

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-73502", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-08-12T19:00:33.736Z", "datePublished": "2026-08-18T17:58:21.320Z", "dateUpdated": "2026-08-18T18:42:16.744Z"}, "containers": {"cna": {"title": "kin-openapi openapi3filter: unauthenticated nil-pointer panic when validating a request against a `content` parameter whose media type has no schema", "problemTypes": [{"descriptions": [{"cweId": "CWE-476", "lang": "en", "description": "CWE-476: NULL Pointer Dereference", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/getkin/kin-openapi/security/advisories/GHSA-jpcw-4wr7-c3vq", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/getkin/kin-openapi/security/advisories/GHSA-jpcw-4wr7-c3vq"}, {"name": "https://github.com/getkin/kin-openapi/commit/68ac2affa325514d7d6e731204d6a1edf6bdff64", "tags": ["x_refsource_MISC"], "url": "https://github.com/getkin/kin-openapi/commit/68ac2affa325514d7d6e731204d6a1edf6bdff64"}, {"name": "https://github.com/getkin/kin-openapi/releases/tag/v0.144.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/getkin/kin-openapi/releases/tag/v0.144.0"}], "affected": [{"vendor": "getkin", "product": "kin-openapi", "versions": [{"version": ">= 0.2.0, < 0.144.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-18T17:58:21.320Z"}, "descriptions": [{"lang": "en", "value": "kin-openapi is a Go project for handling OpenAPI files. From 0.2.0 until 0.144.0, openapi3filter.ValidateRequest can encounter a NULL-pointer-dereference denial of service when an operation declares a content parameter whose application/json media type has no schema. In openapi3filter/req_resp_decoder.go, the default defaultContentParameterDecoder dereferences mt.Schema.Value without checking whether mt.Schema is nil, even though doc.Validate() accepts the document under OpenAPI 3.0.x and 3.1.x. A single unauthenticated request supplying the parameter value can panic request validation, causing an aborted request with log growth in the common synchronous net/http path or a full process crash in integrations without recovery. This issue is fixed in version 0.144.0."}], "source": {"advisory": "GHSA-jpcw-4wr7-c3vq", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/getkin/kin-openapi/security/advisories/GHSA-jpcw-4wr7-c3vq", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-18T18:42:00.680845Z", "id": "CVE-2026-73502", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-18T18:42:16.744Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-73502", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-18T18:42:00.680845Z"}}}], "references": [{"url": "https://github.com/getkin/kin-openapi/security/advisories/GHSA-jpcw-4wr7-c3vq", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-18T18:42:12.808Z"}}], "cna": {"title": "kin-openapi openapi3filter: unauthenticated nil-pointer panic when validating a request against a `content` parameter whose media type has no schema", "source": {"advisory": "GHSA-jpcw-4wr7-c3vq", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "getkin", "product": "kin-openapi", "versions": [{"status": "affected", "version": ">= 0.2.0, < 0.144.0"}]}], "references": [{"url": "https://github.com/getkin/kin-openapi/security/advisories/GHSA-jpcw-4wr7-c3vq", "name": "https://github.com/getkin/kin-openapi/security/advisories/GHSA-jpcw-4wr7-c3vq", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/getkin/kin-openapi/commit/68ac2affa325514d7d6e731204d6a1edf6bdff64", "name": "https://github.com/getkin/kin-openapi/commit/68ac2affa325514d7d6e731204d6a1edf6bdff64", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/getkin/kin-openapi/releases/tag/v0.144.0", "name": "https://github.com/getkin/kin-openapi/releases/tag/v0.144.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "kin-openapi is a Go project for handling OpenAPI files. From 0.2.0 until 0.144.0, openapi3filter.ValidateRequest can encounter a NULL-pointer-dereference denial of service when an operation declares a content parameter whose application/json media type has no schema. In openapi3filter/req_resp_decoder.go, the default defaultContentParameterDecoder dereferences mt.Schema.Value without checking whether mt.Schema is nil, even though doc.Validate() accepts the document under OpenAPI 3.0.x and 3.1.x. A single unauthenticated request supplying the parameter value can panic request validation, causing an aborted request with log growth in the common synchronous net/http path or a full process crash in integrations without recovery. This issue is fixed in version 0.144.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-476", "description": "CWE-476: NULL Pointer Dereference"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-18T17:58:21.320Z"}}}, "cveMetadata": {"cveId": "CVE-2026-73502", "state": "PUBLISHED", "dateUpdated": "2026-08-18T18:42:16.744Z", "dateReserved": "2026-08-12T19:00:33.736Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-18T17:58:21.320Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "kin-openapi", "vendor": "getkin", "versions": [{"status": "affected", "version": ">= 0.2.0, < 0.144.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "kin-openapi is a Go project for handling OpenAPI files. From 0.2.0 until 0.144.0, openapi3filter.ValidateRequest can encounter a NULL-pointer-dereference denial of service when an operation declares a content parameter whose application/json media type has no schema. In openapi3filter/req_resp_decoder.go, the default defaultContentParameterDecoder dereferences mt.Schema.Value without checking whether mt.Schema is nil, even though doc.Validate() accepts the document under OpenAPI 3.0.x and 3.1.x. A single unauthenticated request supplying the parameter value can panic request validation, causing an aborted request with log growth in the common synchronous net/http path or a full process crash in integrations without recovery. This issue is fixed in version 0.144.0."}, {"lang": "es", "value": "kin-openapi es un proyecto Go para manejar archivos OpenAPI. Desde 0.2.0 hasta 0.144.0, openapi3filter.ValidateRequest puede encontrar una denegaci\u00f3n de servicio por desreferencia de puntero NULL cuando una operaci\u00f3n declara un par\u00e1metro de contenido cuyo tipo de medio application/json no tiene esquema. En openapi3filter/req_resp_decoder.go, el defaultContentParameterDecoder predeterminado desreferencia mt.Schema.Value sin verificar si mt.Schema es nulo, a pesar de que doc.Validate() acepta el documento bajo OpenAPI 3.0.x y 3.1.x. Una \u00fanica solicitud no autenticada que proporciona el valor del par\u00e1metro puede causar un p\u00e1nico en la validaci\u00f3n de la solicitud, provocando una solicitud abortada con crecimiento de registros en la ruta s\u00edncrona com\u00fan de net/HTTP o un fallo completo del proceso en integraciones sin recuperaci\u00f3n. Este problema est\u00e1 solucionado en la versi\u00f3n 0.144.0."}], "id": "CVE-2026-73502", "lastModified": "2026-10-22T22:10:00.250", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-73502", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-18T18:42:00.680845Z", "version": "2.0.3"}}]}, "published": "2026-08-18T18:19:33.460", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/getkin/kin-openapi/commit/68ac2affa325514d7d6e731204d6a1edf6bdff64"}, {"source": "security-advisories@github.com", "url": "https://github.com/getkin/kin-openapi/releases/tag/v0.144.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/getkin/kin-openapi/security/advisories/GHSA-jpcw-4wr7-c3vq"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/getkin/kin-openapi/security/advisories/GHSA-jpcw-4wr7-c3vq"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.2.0,0.144.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "kin-openapi", "source": "cna", "vendor": "getkin"}, "product": "kin-openapi", "vendor": "getkin"}], "created": "2026-08-18T20:00:04.530156+00:00", "updated": "2026-08-18T20:15:04.282177+00:00", "vendors": ["getkin", "getkin$PRODUCT$kin-openapi"]}