Most recent entries from all

fkie_cve-2026-100350

kin-openapi is a Go project for handling OpenAPI files. From 0.145.0 until 0.146.0, openapi3filter repeatedly calls regexp.MustCompile for the same parameter-name regular expression inside the per-query-key loop in urlValuesDecoder.DecodeObject used to decode a deepObject query parameter. An unauthenticated remote client can send an affected endpoint a request containing many unrelated query keys, causing ValidateRequest to perform work and allocations proportional to the attacker-controlled key count for every deepObject parameter. The expression itself is fixed and this is not regular expression denial of service; the resource consumption comes from loop-invariant recompilation. This issue is fixed in version 0.146.0.

GHSA-h4r5-mxv5-8mjc — kin-openapi deepObject query decoding repeatedly compiles an invariant regular expression

Affected: Go: github.com/getkin/kin-openapi

### Summary

`openapi3filter` decodes `deepObject`-style query parameters by looping over **every** key in the request's query string. Inside that loop it recompiles a **loop-invariant** regular expression on every iteration. The pattern depends only on the spec-defined parameter name, not on the loop variable, so it is compiled `N` times for `N` query keys instead of once. Because the number of query keys is attacker-controlled and unbounded, a single request with many junk query keys forces a proportional number of `regexp.MustCompile` calls, consuming CPU. A handful of concurrent requests can saturate all cores — an uncontrolled-resource-consumption denial of service.

This is **not** ReDoS: the pattern is fixed (`^<param>\[`) and matches in linear time. The cost is the **repeated compilation** of an invariant regexp, once per attacker-supplied query key.

### Details

In `openapi3filter/req_resp_decoder.go`, the `deepObject` branch of `urlValuesDecoder.DecodeObject` builds a per-parameter property map by iterating over all query keys:

```go case "deepObject": propsFn = func(params url.Values) (map[string]string, error) { props := make(map[string]string) for key, values := range params { // req_resp_decoder.go:689 if !regexp.MustCompile(fmt.Sprintf(`^%s\[`, regexp.QuoteMeta(param))).MatchString(key) { // :690 continue } matches := deepObjectBracketRE.FindAll…

RHSA-2026:76677 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

google.golang.org/protobuf: golang-protobuf: Denial of Service via infinite loop when unmarshaling invalid JSON github.com/moby/sys/user: moby/sys/user: Denial of Service via crafted user or group database files grafana: grafana: Denial of Service via oversized Git Sync responses github.com/getkin/kin-openapi: kin-openapi: Denial of Service via unsupported HTTP methods on static paths github.com/getkin/kin-openapi: kin-openapi: Denial of Service via nil pointer dereference in response validation github.com/getkin/kin-openapi: kin-openapi: Denial of Service via redundant regular expression compilation in query parameter decoding github.com/getkin/kin-openapi: kin-openapi: Authentication bypass via URL path decoding discrepancy axios: Axios: Information disclosure via improper CIDR proxy bypass handling undici: undici: Denial of Service via failed HTTP/2 WebSocket handshake