kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing items

Summary A nil-pointer dereference in openapi3filter lets any unauthenticated client crash a request handler with a single HTTP request against an OpenAPI 3.1 operation that declares type: array without items. OpenAPI 3.1 JSON Schema 2020-12 permits omitting items, and doc.Validate accepts such...

GHSA-P6WJ-QRR4-PGH5 kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing items

Summary A nil-pointer dereference in openapi3filter lets any unauthenticated client crash a request handler with a single HTTP request against an OpenAPI 3.1 operation that declares type: array without items. OpenAPI 3.1 JSON Schema 2020-12 permits omitting items, and doc.Validate accepts such...

PT-2026-120362

Уязвимость функций parseArray, UrlencodedBodyDecoder и MultipartBodyDecoder библиотеки для работы с файлами kin-openapi связана с ошибками разыменования указателей при обработке параметра deepObject. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, вызвать отказ в...