{"uuid": "a15e4f4a-e17b-4271-aad9-8beb0131e154", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-76905", "type": "seen", "source": "https://gist.github.com/alon710/a8fb06e2d4be25e5dcde47f19754cbdb", "content": "# CVE-2026-76905: CVE-2026-76905: Denial of Service via Nil-Pointer Dereference in getkin/kin-openapi openapi3filter\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-08-21\n> **Full Report:** https://cvereports.com/reports/CVE-2026-76905\n\n## Summary\nCVE-2026-76905 is a high-severity Denial of Service (DoS) vulnerability in the getkin/kin-openapi library, specifically inside the openapi3filter sub-package. When processing multipart/form-data request validation errors, a missing nil-pointer guard causes a Go runtime panic during error formatting. This panic terminates the active server process if no recovery handler is present, resulting in a total denial of service. The vulnerability affects versions from v0.10.0 to v0.140.0, and is resolved in v0.141.0.\n\n## TL;DR\nUnauthenticated remote attackers can crash servers using getkin/kin-openapi (v0.10.0 to v0.140.0) by transmitting a malformed multipart/form-data request, triggering a nil-pointer dereference panic in the error validation encoder.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-476\n- **Attack Vector**: Network\n- **CVSS Score**: 7.5\n- **EPSS Percentile**: N/A\n- **Impact**: Denial of Service (DoS)\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Go applications using getkin/kin-openapi in combination with openapi3filter validation handlers.\n- **github.com/getkin/kin-openapi**: >= 0.10.0, < 0.141.0 (Fixed in: `v0.141.0`)\n\n## Mitigation\n\n- Upgrade to getkin/kin-openapi v0.141.0 or newer.\n- Deploy a panic recovery middleware helper at the HTTP handler layer to isolate and catch runtime panics.\n- Formulate client-side error responses using custom formatting wrappers that bypass the vulnerable ConvertErrors API.\n\n**Remediation Steps:**\n1. Open the active project directory containing the vulnerable go.mod file.\n2. Update the dependency to the patched version: go get github.com/getkin/kin-openapi@v0.141.0\n3. Verify and clean the dependency tree using: go mod tidy\n4. Verify the installation of panic-recovery middleware configurations at the root router level to guarantee fallback resilience.\n5. Recompile and redeploy the patched binaries to production environments.\n\n## References\n\n- [GitHub Security Advisory GHSA-mmfr-pmjx-hw9w](https://github.com/getkin/kin-openapi/security/advisories/GHSA-mmfr-pmjx-hw9w)\n- [Patch Commit 1d0a337c9b1570fab283be8a04c8af6e43b9a22c](https://github.com/getkin/kin-openapi/commit/1d0a337c9b1570fab283be8a04c8af6e43b9a22c)\n- [Release Tag v0.141.0](https://github.com/getkin/kin-openapi/releases/tag/v0.141.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-76905) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-22T05:32:17.976868Z"}