kin-openapi: Uncontrolled resource consumption in openapi3filter deepObject query parameter decoding

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-77354 · Microsoft / collected KEV context

EUVD-2026-64151

GHSA-xhj3-7xw9-vr34

GO-2026-6275

cve-program · CVE-2026-77354

• https://github.com/getkin/kin-openapi/security/advisories/GHSA-xhj3-7xw9-vr34
• https://github.com/getkin/kin-openapi/pull/923
• https://github.com/getkin/kin-openapi/commit/1223a0f215d2cf9beb2d9eb9ea2649d001c21388
• https://github.com/getkin/kin-openapi/releases/tag/v0.142.0

euvd · EUVD-2026-64151

• https://github.com/getkin/kin-openapi/security/advisories/GHSA-xhj3-7xw9-vr34
• https://github.com/getkin/kin-openapi/pull/923
• https://github.com/getkin/kin-openapi/commit/1223a0f215d2cf9beb2d9eb9ea2649d001c21388
• https://github.com/getkin/kin-openapi/releases/tag/v0.142.0

nvd · CVE-2026-77354

• https://github.com/getkin/kin-openapi/commit/1223a0f215d2cf9beb2d9eb9ea2649d001c21388
• https://github.com/getkin/kin-openapi/pull/923
• https://github.com/getkin/kin-openapi/releases/tag/v0.142.0
• https://github.com/getkin/kin-openapi/security/advisories/GHSA-xhj3-7xw9-vr34

osv · GHSA-xhj3-7xw9-vr34

• https://github.com/getkin/kin-openapi/security/advisories/GHSA-xhj3-7xw9-vr34
• https://github.com/getkin/kin-openapi/commit/1223a0f215d2cf9beb2d9eb9ea2649d001c21388
• https://github.com/getkin/kin-openapi
• https://github.com/getkin/kin-openapi/releases/tag/v0.142.0

osv · GO-2026-6275

• https://github.com/getkin/kin-openapi/security/advisories/GHSA-xhj3-7xw9-vr34
• https://github.com/getkin/kin-openapi/commit/1223a0f215d2cf9beb2d9eb9ea2649d001c21388
• https://github.com/getkin/kin-openapi/releases/tag/v0.142.0

• kin-openapi is a Go project for handling OpenAPI files. From 0.124.0 until 0.142.0, openapi3filter.sliceMapToSlice in openapi3filter/req_resp_decoder.go converts attacker-controlled sparse indexes from a deepObject query parameter into a de… · Advisory content revised · 9 Nov 2026
• kin-openapi is a Go project for handling OpenAPI files. From 0.124.0 until 0.142.0, openapi3filter.sliceMapToSlice in openapi3filter/req_resp_decoder.go converts attacker-controlled sparse indexes from a deepObject query parameter into a de… · Advisory content revised · 7 Nov 2026
• kin-openapi is a Go project for handling OpenAPI files. From 0.124.0 until 0.142.0, openapi3filter.sliceMapToSlice in openapi3filter/req_resp_decoder.go converts attacker-controlled sparse indexes from a deepObject query parameter into a de… · Advisory content revised · 1 Nov 2026