https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 22:07:57 +0000 https://vulnerability.circl.lu/vuln/ghsa-wq9g-9vfc-cfq9 <p><strong>Affected:</strong> Go: github.com/getkin/kin-openapi</p> <p>### Summary</p> <p>When validating a request with a multipart/form-data schema, if the OpenAPI schema allows it, an attacker can upload a crafted ZIP file (e.g., a ZIP bomb), causing the server to consume all available system memory.</p> <p>### Details</p> <p>The root cause comes from the [ZipFileBodyDecoder](https://github.com/getkin/kin-openapi/blob/6da871e0e170b7637eb568c265c08bc2b5d6e7a3/openapi3filter/req_resp_decoder.go#L1523), which is registered [automatically](https://github.com/getkin/kin-openapi/blob/6da871e0e170b7637eb568c265c08bc2b5d6e7a3/openapi3filter/req_resp_decoder.go#L1275) by the module (contrary to what the [documentation says](https://github.com/getkin/kin-openapi?tab=readme-ov-file#custom-content-type-for-body-of-http-requestresponse).</p> <p>### PoC To reproduce the vulnerability, you can use the following OpenAPI schema: ```yaml openapi: 3.0.0 info: title: &#39;Validator&#39; version: 0.0.1 paths: /: post: requestBody: required: true content: multipart/form-data: schema: type: object required: - file properties: file: type: string format: binary responses: &#39;200&#39;: description: Created ``` And this code to validate the request (nothing fancy, it basically only calls the `openapi3filter.ValidateRequest` function`): ```go package main</p> <p>import ( &#34;fmt&#34; &#34;log&#34; &#34;net/http&#34;</p> <p>&#34;github.com/getkin/kin-openap…</p> <p><strong>Affected:</strong> Go: github.com/getkin/kin-openapi</p> <p>### Summary</p> <p>When validating a request with a multipart/form-data schema, if the OpenAPI schema allows it, an attacker can upload a crafted ZIP file (e.g., a ZIP bomb), causing the server to consume all available system memory.</p> <p>### Details</p> <p>The root cause comes from the [ZipFileBodyDecoder](https://github.com/getkin/kin-openapi/blob/6da871e0e170b7637eb568c265c08bc2b5d6e7a3/openapi3filter/req_resp_decoder.go#L1523), which is registered [automatically](https://github.com/getkin/kin-openapi/blob/6da871e0e170b7637eb568c265c08bc2b5d6e7a3/openapi3filter/req_resp_decoder.go#L1275) by the module (contrary to what the [documentation says](https://github.com/getkin/kin-openapi?tab=readme-ov-file#custom-content-type-for-body-of-http-requestresponse).</p> <p>### PoC To reproduce the vulnerability, you can use the following OpenAPI schema: ```yaml openapi: 3.0.0 info: title: &#39;Validator&#39; version: 0.0.1 paths: /: post: requestBody: required: true content: multipart/form-data: schema: type: object required: - file properties: file: type: string format: binary responses: &#39;200&#39;: description: Created ``` And this code to validate the request (nothing fancy, it basically only calls the `openapi3filter.ValidateRequest` function`): ```go package main</p> <p>import ( &#34;fmt&#34; &#34;log&#34; &#34;net/http&#34;</p> <p>&#34;github.com/getkin/kin-openap…</p> https://vulnerability.circl.lu/vuln/ghsa-wq9g-9vfc-cfq9