CVE-2026-73502: kin-openapi openapi3filter: unauthenticated nil-pointer panic when validating a request against a `content` parameter whose media type has no schema
kin-openapi is a Go project for handling OpenAPI files. From 0.2.0 until 0.144.0, openapi3filter.ValidateRequest can encounter a NULL-pointer-dereference denial of service when an operation declares a content parameter whose application/json media type has no schema. In openapi3filter/reqrespdecoder.go, the default defaultContentParameterDecoder dereferences mt.Schema.Value without checking whether mt.Schema is nil, even though doc.Validate() accepts the document under OpenAPI 3.0.x and 3.1.x. A single unauthenticated request supplying the parameter value can panic request validation, causing an aborted request with log growth in the common synchronous net/http path or a full process crash in integrations without recovery. This issue is fixed in version 0.144.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
kin-openapi openapi3filterto a version that resolves this vulnerability.Fixed in 0.144.0
Event History
Frequently Asked Questions
Which deployments are affected?
Applications using openapi3filter.ValidateRequest are exposed if an operation declares a content parameter with an application/json media type whose schema is absent. The affected range is 0.2.0 through versions before 0.144.0; documents can pass doc.Validate() under both OpenAPI 3.0.x and 3.1.x despite containing the triggering definition.
What does an attacker need to trigger the failure?
An attacker needs only to send a single unauthenticated request that supplies the affected parameter value. No privileges or user interaction are required.
What can be done if patching is delayed?
Upgrade to version 0.144.0. If an immediate upgrade is not possible, avoid or correct content parameters that use application/json without a schema, and ensure request-handling integrations recover from panics to prevent a process-wide crash.
How can I determine whether my application is already affected?
Review OpenAPI operations used for request validation for content parameters whose application/json media type lacks a schema. In a vulnerable integration, supplying such a parameter can cause request validation to panic; synchronous net/http handling may show aborted requests and growing logs, while integrations without recovery may crash the process.