MAL-2025-164391 Malicious code in polil-akilu-kin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b0a63dd48b8df2aaae0faff83f09314095ddfdd3f83b1c287f026329b72f2ed This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-164102 Malicious code in pilau-aku-kin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d01a2059d67ed016f56d9da0cbdbaff31802d95faf562615c8d62f9025e2fa0a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in pilu-aku-kin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1cb0ce89277377216ea8dc11263a6b11dd4b2fde9a50c1da5e655a804cd11c18 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-164093 Malicious code in pilau-akaviu-kin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 378047f5d90bcd7060fa530db42bc90045c9adbabfffa7234d262aa1f184b217 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in polil-akilmu-kin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 62197586f725cd959d53464bc59448a5a517e33bb73afefbe657b2d613221915 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in polil-akiu-kin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a175fdb78181acc40afc67dabe2f32e509a5c3a3059ce04b7080a6d576d42557 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-164390 Malicious code in polil-akilmu-kin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 62197586f725cd959d53464bc59448a5a517e33bb73afefbe657b2d613221915 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-164103 Malicious code in pilau-akvu-kin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08ba35902c0c1210305d39f2ddbe4081de0d0c283a5f77de8a1df9e8e1667ea9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-164393 Malicious code in polil-aku-kin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 83e28bb24505dfc4e6702eb5d85f67721d91d38dbb62436cde83596363fd69c6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

SUSE CVE-2025-30153

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.131.0, when validating a request with a multipart/form-data schema, if the OpenAPI schema allows it, an attacker can upload a crafted ZIP file e.g., a ZIP bomb, causing the server to consume all available system memory. The root...

Denial Of Service (DoS)

github.com/getkin/kin-openapi is vulnerable to Denial Of Service DoS. The vulnerability is due to the ZipFileBodyDecoder being automatically registered by the module, contrary to the documentation, allowing attackers to upload malicious ZIP files and cause excessive memory usage...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification through the ZipFileBodyDecoder. An attacker can trigger an out-of-memory condition, leading to server crashes or degraded performance by uploading a specially crafted ZIP fi...

CVE-2025-30153

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.131.0, when validating a request with a multipart/form-data schema, if the OpenAPI schema allows it, an attacker can upload a crafted ZIP file e.g., a ZIP bomb, causing the server to consume all available system memory. The root...

CVE-2025-30153 Improper Handling of Highly Compressed Data (Data Amplification) in github.com/getkin/kin-openapi/openapi3filter

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.131.0, when validating a request with a multipart/form-data schema, if the OpenAPI schema allows it, an attacker can upload a crafted ZIP file e.g., a ZIP bomb, causing the server to consume all available system memory. The root...

CVE-2025-30153

CVE-2025-30153 affects kin-openapi (Go) prior to 0.131.0. The issue occurs when validating a request with a multipart/form-data schema: if the OpenAPI schema allows it, an attacker can upload a crafted ZIP file (e.g., a ZIP bomb) that causes the server to exhaust memory. The root cause is the Zip...

CVE-2025-30153 Improper Handling of Highly Compressed Data (Data Amplification) in github.com/getkin/kin-openapi/openapi3filter

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.131.0, when validating a request with a multipart/form-data schema, if the OpenAPI schema allows it, an attacker can upload a crafted ZIP file e.g., a ZIP bomb, causing the server to consume all available system memory. The root...

CVE-2025-30153 Improper Handling of Highly Compressed Data (Data Amplification) in github.com/getkin/kin-openapi/openapi3filter

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.131.0, when validating a request with a multipart/form-data schema, if the OpenAPI schema allows it, an attacker can upload a crafted ZIP file e.g., a ZIP bomb, causing the server to consume all available system memory. The root...

kin-openapi 安全漏洞

kin-openapi is a getkin open source implementation of OpenAPI 3.0 for Go parsing, transforming, validating, etc.. A security vulnerability exists in kin-openapi versions prior to 0.131.0, which stems from a potential memory exhaustion when processing multipart/form-data requests...

PT-2025-11700

Name of the Vulnerable Software and Affected Versions kin-openapi versions prior to 0.131.0 Description The issue arises when validating a request with a multipart/form-data schema. If the OpenAPI schema allows it, an attacker can upload a crafted ZIP file, such as a ZIP bomb, causing the server ...

kin-chin.com Cross Site Scripting vulnerability OBB-3627271

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...