{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3agetkinkin-openapi/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:getkin:kin-openapi:*:*:*:*:*:*:*:*"],"_cs_cves":[],"_cs_exploited":true,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["kin-openapi (\u003c 0.149.0)","kin-openapi (\u003c 0.148.0)","jsonschema (v6.0.2)","kin-openapi (\u003e= 0.144.0, \u003c 0.147.0)","kin-openapi"],"_cs_severities":["high"],"_cs_tags":["denial-of-service","vulnerability","openapi","go","authentication-bypass","path-confusion","web-application-vulnerability"],"_cs_type":"threat","_cs_vendors":["getkin","santhosh-tekuri"],"content_html":"\u003cp\u003eThe kin-openapi library (versions prior to 0.149.0) contains a critical flaw in its runtime schema validation logic. While the library's spec-loader and \u003ccode\u003eSchema.validate()\u003c/code\u003e method implement cycle detection to handle circular references in OpenAPI schemas, the runtime validators \u003ccode\u003eVisitJSON\u003c/code\u003e (used for response validation) and \u003ccode\u003edecodeValue\u003c/code\u003e (used for request parameter decoding) lack these protections.\u003c/p\u003e\n\u003cp\u003eWhen a circular combinator chain (such as \u003ccode\u003eallOf\u003c/code\u003e, \u003ccode\u003eanyOf\u003c/code\u003e, or \u003ccode\u003eoneOf\u003c/code\u003e) is encountered during request or response processing, the library enters an infinite recursion loop. In Go, this eventually exhausts the goroutine stack, triggering a fatal \u003ccode\u003eruntime: goroutine stack exceeds ... limit\u003c/code\u003e error. Because this is a fatal runtime error rather than a panic, it cannot be intercepted by \u003ccode\u003erecover()\u003c/code\u003e blocks in \u003ccode\u003enet/http\u003c/code\u003e handlers. Consequently, any request triggering this path causes the entire application process to crash, resulting in a total denial-of-service for all clients sharing that process. This affects any application using kin-openapi for request/response validation, whether the circular schema is provided by a malicious actor or exists as a latent bug in a legitimate API specification.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies an application endpoint utilizing \u003ccode\u003ekin-openapi\u003c/code\u003e for request or response validation.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious OpenAPI specification, or leverages an existing one, containing a circular combinator reference (e.g., a \u003ccode\u003eSchema\u003c/code\u003e object with an \u003ccode\u003eallOf\u003c/code\u003e field pointing back to itself).\u003c/li\u003e\n\u003cli\u003eThe target application loads the malicious specification into memory via the \u003ccode\u003ekin-openapi\u003c/code\u003e loader, which treats the circularity as a valid data structure.\u003c/li\u003e\n\u003cli\u003eThe application receives a legitimate HTTP request routed to an endpoint governed by the circular schema definition.\u003c/li\u003e\n\u003cli\u003eThe library's \u003ccode\u003eopenapi3filter\u003c/code\u003e or \u003ccode\u003eVisitJSON\u003c/code\u003e component processes the input against the circular combinator chain.\u003c/li\u003e\n\u003cli\u003eThe lack of stack-based cycle detection causes the recursion to continue indefinitely.\u003c/li\u003e\n\u003cli\u003eThe Go runtime triggers a fatal stack overflow error.\u003c/li\u003e\n\u003cli\u003eThe entire application process terminates, resulting in a successful denial-of-service.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability results in an unrecoverable, process-wide denial-of-service. Because the Go runtime error is fatal, all concurrent connections served by the same process are immediately dropped. The threat is particularly severe for API gateways, mock servers, or any infrastructure that dynamically loads or validates OpenAPI specifications from user-supplied inputs. Even in deployments using static, trusted specifications, the presence of a circular reference leads to a persistent, triggered crash upon any interaction with the affected endpoint.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate \u003ccode\u003ekin-openapi\u003c/code\u003e to version 0.149.0 or later, which implements mandatory cycle detection in both \u003ccode\u003eVisitJSON\u003c/code\u003e and \u003ccode\u003edecodeValue\u003c/code\u003e paths.\u003c/li\u003e\n\u003cli\u003eImplement strict validation for any OpenAPI specifications loaded from untrusted or external sources before they are used for runtime validation.\u003c/li\u003e\n\u003cli\u003eIn environments where immediate patching is not possible, implement an upstream WAF rule to scan for and block YAML/JSON inputs containing recursive \u003ccode\u003eallOf\u003c/code\u003e, \u003ccode\u003eanyOf\u003c/code\u003e, or \u003ccode\u003eoneOf\u003c/code\u003e structures.\u003c/li\u003e\n\u003cli\u003eDeploy monitoring to identify and alert on \u003ccode\u003efatal error: stack overflow\u003c/code\u003e entries in application log files, which signal active exploitation or the presence of a broken schema.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-15T22:24:31Z","date_published":"2026-10-15T22:23:51Z","id":"https://feed.craftedsignal.io/briefs/2026-10-kin-openapi-recursion-dos/","summary":"The kin-openapi library lacks cycle detection during runtime schema validation, allowing attackers to trigger an unrecoverable Go runtime stack overflow that terminates the entire host process.","title":"Uncontrolled Recursion DoS in kin-openapi","url":"https://feed.craftedsignal.io/briefs/2026-10-kin-openapi-recursion-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:getkin:kin-Openapi:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}