{"items":[{"id":"NVI-00013859","kind":"vulnerability","title":"kin-openapi has uncontrolled resource consumption in openapi3filter deepObject query parameter decoding","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-xhj3-7xw9-vr34","CVE-2026-77354"],"plain_summary":"GitHub lists this reviewed advisory for github.com/getkin/kin-openapi. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-1153a8dd5abb5fe1284f38f4d87fddd1"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-1153a8dd5abb5fe1284f38f4d87fddd1","url":"https://github.com/advisories/GHSA-xhj3-7xw9-vr34","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-xhj3-7xw9-vr34","publisher":"GitHub Advisory Database","observed_at":"2026-11-02T09:56:46.713Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-1153a8dd5abb5fe1284f38f4d87fddd1"],"technology":"github.com/getkin/kin-openapi","known_exclusions":[],"conditions_summary":"### Summary\n\nAn uncontrolled resource consumption vulnerability in `openapi3filter` lets any unauthenticated client force multi-gigabyte heap allocation with a single, tiny HTTP request. When a spec declares a `deepObject`-style query parameter whose schema contains an array (a normal, documented pattern), the decoder reconstructs the array by reading the **largest attacker-supplied index** and allocating one slot for every position from `0` up to that index — *before* schema validation (including `maxItems`) ever runs. A request as small as 24 bytes (`?param[items][50000000]=x`) drives heap allocation to **~6.1 GiB**, reliably triggering an OOM kill / restart loop on memory-constrained services.\n\n### Details\n\nThe OpenAPI `style: deepObject` serialization lets clients express arrays in the query string using bracket notation, e.g. `param[items][0]=a&param[items][1]=b`. The decoder first collects these into an intermediate `map[string]any` keyed by the string of the index, then converts that sparse map into a real `[]any` in `sliceMapToSlice`:\n\n```go\n// req_resp_decoder.go (vulnerable versio","public_affected_ranges":[">= 0.124.0, < 0.142.0"]}],"null_published_at":"2026-11-02T10:00:37.162Z","source_updated_at":"2026-08-21T20:56:57.000Z","source_disclosed_at":"2026-08-21T20:56:56.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-02T09:56:46.713Z"}],"next_cursor":null,"snapshot_revision":"42594"}