{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/kin-openapi-v0.124.0---v0.141.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["kin-openapi (v0.124.0 - v0.141.0)","kin-openapi"],"_cs_severities":["medium"],"_cs_tags":["denial-of-service","memory-exhaustion","vulnerability","golang"],"_cs_type":"advisory","_cs_vendors":["getkin"],"content_html":"\u003cp\u003eThe \u003ccode\u003eopenapi3filter\u003c/code\u003e component within \u003ccode\u003ekin-openapi\u003c/code\u003e (versions \u003ccode\u003ev0.124.0\u003c/code\u003e through \u003ccode\u003ev0.141.0\u003c/code\u003e) is vulnerable to uncontrolled resource consumption. When the library processes query parameters serialized with \u003ccode\u003estyle: deepObject\u003c/code\u003e, it attempts to reconstruct arrays from bracketed indices (e.g., \u003ccode\u003eparam[items][50000000]=x\u003c/code\u003e). The decoder materializes the full array based on the highest index provided by the client before any schema validation occurs. Consequently, a small, 24-byte HTTP request can force the application to allocate gigabytes of memory, leading to an OOM (Out of Memory) crash. Because validation logic like \u003ccode\u003emaxItems\u003c/code\u003e runs after this materialization process, it cannot prevent the initial memory exhaustion. This vulnerability affects any service using \u003ccode\u003ekin-openapi\u003c/code\u003e for request validation that exposes an OpenAPI operation with a \u003ccode\u003edeepObject\u003c/code\u003e array parameter.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies an endpoint utilizing \u003ccode\u003ekin-openapi\u003c/code\u003e that processes \u003ccode\u003edeepObject\u003c/code\u003e query parameters containing an array schema.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a minimal HTTP GET request containing a \u003ccode\u003edeepObject\u003c/code\u003e query parameter with a high-value integer index (e.g., \u003ccode\u003eparam[items][50000000]=x\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ekin-openapi\u003c/code\u003e router identifies the route and passes the request to \u003ccode\u003eopenapi3filter.ValidateRequest\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe decoder parses the query string and enters \u003ccode\u003esliceMapToSlice\u003c/code\u003e, which identifies the maximum user-supplied index.\u003c/li\u003e\n\u003cli\u003eThe library performs an unbounded loop from 0 to the attacker-supplied maximum index to initialize a \u003ccode\u003e[]any\u003c/code\u003e slice, allocating memory for every index in the range.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ebuildResObj\u003c/code\u003e function performs a second, equally-sized allocation for the final result array.\u003c/li\u003e\n\u003cli\u003eThe application service crashes due to excessive heap allocation, causing a denial-of-service.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an unauthenticated remote attacker to cause a denial-of-service by forcing an application crash. The amplification factor is extreme; a 24-byte request can force an allocation of ~6.1 GiB. This vulnerability impacts any service infrastructure relying on \u003ccode\u003ekin-openapi\u003c/code\u003e for API request validation, potentially leading to widespread service unavailability for affected applications.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eIdentify all services utilizing \u003ccode\u003ekin-openapi\u003c/code\u003e versions between \u003ccode\u003ev0.124.0\u003c/code\u003e and \u003ccode\u003ev0.141.0\u003c/code\u003e that expose \u003ccode\u003edeepObject\u003c/code\u003e query parameters.\u003c/li\u003e\n\u003cli\u003eUpgrade the \u003ccode\u003ekin-openapi\u003c/code\u003e dependency to a patched version once available from the maintainers.\u003c/li\u003e\n\u003cli\u003eImplement a Web Application Firewall (WAF) or upstream proxy to drop requests containing extremely large integer values within bracketed query parameters (e.g., \u003ccode\u003e\\[[0-9]{7,}\\]\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eMonitor application server logs for frequent crash loops or OOM-related restart events following the deployment of this library.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-08-22T01:17:25Z","date_published":"2026-08-22T01:17:17Z","id":"https://feed.craftedsignal.io/briefs/2026-08-kin-openapi-dos/","summary":"An unauthenticated remote attacker can cause a denial-of-service via memory exhaustion by supplying a large integer index in a 'deepObject' style query parameter.","title":"Uncontrolled Resource Consumption in kin-openapi deepObject Decoder","url":"https://feed.craftedsignal.io/briefs/2026-08-kin-openapi-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Kin-Openapi (V0.124.0 - V0.141.0)","version":"https://jsonfeed.org/version/1.1"}