Skip to content
Threat Feed
Subscribe

Vendor

Getkin

3 briefs RSS
high threat

Uncontrolled Recursion DoS in kin-openapi

The kin-openapi library lacks cycle detection during runtime schema validation, allowing attackers to trigger an unrecoverable Go runtime stack overflow that terminates the entire host process.

exploited kin-openapi +4 denial-of-service vulnerability openapi go authentication-bypass path-confusion web-application-vulnerability
4t
medium advisory

Uncontrolled Resource Consumption in kin-openapi deepObject Decoder

An unauthenticated remote attacker can cause a denial-of-service via memory exhaustion by supplying a large integer index in a 'deepObject' style query parameter.

kin-openapi +1 denial-of-service memory-exhaustion vulnerability golang
1t
critical advisory

Authentication Bypass in kin-openapi Due to Default NoopAuthenticationFunc

An authentication bypass vulnerability (CWE-287) exists in the `openapi3filter.ValidationHandler` component of the `getkin/kin-openapi` library (versions <= v0.143.0), where the `ValidationHandler.Load()` method silently defaults to a `NoopAuthenticationFunc` when an explicit function is not provided, allowing unauthenticated remote attackers to bypass OpenAPI security requirements and access protected endpoints in Go services.

kin-openapi authentication-bypass api golang library-vulnerability cwe-287
1t