GHSA-JPCW-4WR7-C3VQ kin-openapi openapi3filter: unauthenticated nil-pointer panic when validating a request against a `content` parameter whose media type has no schema

| Field | Value | |---|---| | Ecosystem | Go | | Package | github.com/getkin/kin-openapi | | Affected versions | = 0.143.0 introduced in v0.2.0, PR 90, 2019-05-07; reproduced on HEAD 30e2923 | | Patched versions | 0.144.0 | --- Summary openapi3filter.ValidateRequest contains a...

GHSA-R277-6W6Q-XMQW kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default

Summary ValidationHandler.Load in getkin/kin-openapi silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which always returns nil without performing any credential check. Because this substitution happens unconditionally when the caller omits the field, every OpenAPI security...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication due to the unconditional substitution of a nil AuthenticationFunc with a no-op function in the Load process. An attacker can gain unauthorized access to protected endpoints by sending unauthenticated requests, as...

PT-2026-71357

Name of the Vulnerable Software and Affected Versions kin-openapi versions prior to 0.144.0 Description In the ValidationHandler.Load function within openapi3filter/validation handler.go, a nil AuthenticationFunc is silently replaced with NoopAuthenticationFunc. This function returns nil without...

PT-2026-76594

Name of the Vulnerable Software and Affected Versions kin-openapi versions 0.2.0 through 0.143.0 Description An unauthenticated remote denial of service exists when the openapi3filter.ValidateRequest function processes an operation that declares a content parameter where the application/json medi...

PT-2026-79474

Name of the Vulnerable Software and Affected Versions kin-openapi versions 0.124.0 through 0.141.0 Description An unauthenticated client can trigger a denial of service by sending a query with sparse indexes in a deepObject query parameter to an endpoint whose schema contains an array. The functi...

PT-2026-79472

Name of the Vulnerable Software and Affected Versions kin-openapi versions 0.10.0 through 0.140.0 Description The openapi3filter.convertParseError function in openapi3filter/validation error encoder.go dereferences e.Parameter.In without verifying if e.Parameter is nil. When a multipart/form-data...

Malicious code in modiov-kin-afbau (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b6a6aec576e9ed6b84a41d4c536b4d49f5afd10f48b9fc99b4521c308408a30 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in modiov-kin-afbaufcaducc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f5999ce6f680bfae47868a925114f9a529d187e849b82a4039e2a3ba90125f41 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in modiov-kin-afud (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d306c24f85e12a32bba8f972b3a678131011133e3e531d46c06dea0e99a76c30 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in modiov-kin-afuds (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e500ac0bb902e6244d5f7bee90f0ed891400e015bc7a9fdec9837985201286d2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in modiov-kin-afudsa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0b359e4c6a02b047a420d4c60ec94f09089a2e12e1d5a90aa1a396ab81f0ff0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in modiov-kin-afudsaczubfa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3fd48b0d2620a33f49c71f7e692a7bfd04f314116ceb2461c5f9f5acae9a515f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in modiov-kin-afudsaczu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector abb163aca205098cf974cbc41c5d6e98b591fdb57ef95bba3b5969664c4edbf9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-184443 Malicious code in modiov-kin-afbaufcaducxacs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50ff912c0087efe4e11ff6a12bc496608a99126131250e1a19b34525b360b519 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in pilu-aku-kin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1cb0ce89277377216ea8dc11263a6b11dd4b2fde9a50c1da5e655a804cd11c18 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in polil-akilmu-kin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 62197586f725cd959d53464bc59448a5a517e33bb73afefbe657b2d613221915 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in polil-akilu-kin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b0a63dd48b8df2aaae0faff83f09314095ddfdd3f83b1c287f026329b72f2ed This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in polil-akiu-kin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a175fdb78181acc40afc67dabe2f32e509a5c3a3059ce04b7080a6d576d42557 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in pilau-akaviu-kin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 378047f5d90bcd7060fa530db42bc90045c9adbabfffa7234d262aa1f184b217 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...