14 matches found
NULL Pointer Dereference
Overview Affected versions of this package are vulnerable to NULL Pointer Dereference through the ValidateResponse process when a response header is declared with content instead of schema. An attacker can cause a process crash by sending a request to an affected endpoint, resulting in a nil...
NULL Pointer Dereference
Overview Affected versions of this package are vulnerable to NULL Pointer Dereference due to improper handling of array schemas that omit the items keyword in request validation. An attacker can cause the application to panic and potentially crash by submitting crafted requests that trigger...
Uncontrolled Recursion
Overview Affected versions of this package are vulnerable to Uncontrolled Recursion through the visitJSON and decodeValue functions when processing schemas with circular references in allOf, anyOf, or oneOf combinators. An attacker can cause a fatal process crash by submitting a crafted OpenAPI...
Uncontrolled Recursion
Overview Affected versions of this package are vulnerable to Uncontrolled Recursion through the visitJSON and decodeValue functions when processing schemas with circular references in allOf, anyOf, or oneOf combinators. An attacker can cause a fatal process crash by submitting a crafted OpenAPI...
GHSA-23VG-4CJM-66Q5 kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion
Summary openapi3filter.ValidationHandler.Middleware validates requests with kin-openapi's legacy router, which selects an OpenAPI operation from the decoded URL.Path. The method is documented as implementing gorilla/mux.MiddlewareFunc, but a downstream gorilla/mux router configured with...
kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion
Summary openapi3filter.ValidationHandler.Middleware validates requests with kin-openapi's legacy router, which selects an OpenAPI operation from the decoded URL.Path. The method is documented as implementing gorilla/mux.MiddlewareFunc, but a downstream gorilla/mux router configured with...
Excessive Platform Resource Consumption within a Loop
Overview Affected versions of this package are vulnerable to Excessive Platform Resource Consumption within a Loop through repeated compilation of a loop-invariant regular expression inside the DecodeObject process. An attacker can exhaust CPU resources and degrade or deny service to legitimate...
NULL Pointer Dereference
Overview Affected versions of this package are vulnerable to NULL Pointer Dereference through the resolveComponent process in the OpenAPI specification loader when handling a self-referential $ref in additionalProperties without proper nil-checks. An attacker can cause the application to crash by...
Uncaught Exception
Overview Affected versions of this package are vulnerable to Uncaught Exception via the ValidationHandler process. An attacker can cause the application to panic and disrupt service availability by sending HTTP requests with non-canonical or unsupported HTTP method tokens to any existing static...
Uncaught Exception
Overview Affected versions of this package are vulnerable to Uncaught Exception via the ValidationHandler process. An attacker can cause the application to panic and disrupt service availability by sending HTTP requests with non-canonical or unsupported HTTP method tokens to any existing static...
Uncaught Exception
Overview Affected versions of this package are vulnerable to Uncaught Exception via the ValidationHandler process. An attacker can cause the application to panic and disrupt service availability by sending HTTP requests with non-canonical or unsupported HTTP method tokens to any existing static...
NULL Pointer Dereference
Overview Affected versions of this package are vulnerable to NULL Pointer Dereference in the openapi3filter process when handling OpenAPI 3.1 schemas that declare an array type without specifying items. An attacker can cause the application to crash by sending a crafted HTTP request with a...
