kin-openapi openai3filter: nil-pointer panic in ConvertErrors on malformed multipart/form-data body enables unauthenticated DoS

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-76905 · Microsoft / collected KEV context

EUVD-2026-64150

GHSA-mmfr-pmjx-hw9w

GO-2026-6274

cve-program · CVE-2026-76905

• https://github.com/getkin/kin-openapi/security/advisories/GHSA-mmfr-pmjx-hw9w
• https://github.com/getkin/kin-openapi/commit/1d0a337c9b1570fab283be8a04c8af6e43b9a22c
• https://github.com/getkin/kin-openapi/releases/tag/v0.141.0

euvd · EUVD-2026-64150

• https://github.com/getkin/kin-openapi/security/advisories/GHSA-mmfr-pmjx-hw9w
• https://github.com/getkin/kin-openapi/commit/1d0a337c9b1570fab283be8a04c8af6e43b9a22c
• https://github.com/getkin/kin-openapi/releases/tag/v0.141.0

nvd · CVE-2026-76905

• https://github.com/getkin/kin-openapi/commit/1d0a337c9b1570fab283be8a04c8af6e43b9a22c
• https://github.com/getkin/kin-openapi/releases/tag/v0.141.0
• https://github.com/getkin/kin-openapi/security/advisories/GHSA-mmfr-pmjx-hw9w

osv · GHSA-mmfr-pmjx-hw9w

• https://github.com/getkin/kin-openapi/security/advisories/GHSA-mmfr-pmjx-hw9w
• https://github.com/getkin/kin-openapi/commit/1d0a337c9b1570fab283be8a04c8af6e43b9a22c
• https://github.com/getkin/kin-openapi
• https://github.com/getkin/kin-openapi/releases/tag/v0.141.0

osv · GO-2026-6274

• https://github.com/getkin/kin-openapi/security/advisories/GHSA-mmfr-pmjx-hw9w
• https://github.com/getkin/kin-openapi/commit/1d0a337c9b1570fab283be8a04c8af6e43b9a22c
• https://github.com/getkin/kin-openapi/releases/tag/v0.141.0

• kin-openapi is a Go project for handling OpenAPI files. From 0.10.0 until 0.141.0, openapi3filter.convertParseError in openapi3filter/validation_error_encoder.go dereferences e.Parameter.In without checking whether e.Parameter is nil. A mal… · Advisory content revised · 9 Nov 2026