CVE-2026-76905

{"id": "CVE-2026-76905", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-76905", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-25T14:21:31.513270Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "getkin", "product": "kin-openapi", "versions": [{"status": "affected", "version": ">= 0.10.0, < 0.141.0"}]}]}], "published": "2026-08-21T21:17:06.320", "references": [{"url": "https://github.com/getkin/kin-openapi/commit/1d0a337c9b1570fab283be8a04c8af6e43b9a22c", "source": "security-advisories@github.com"}, {"url": "https://github.com/getkin/kin-openapi/releases/tag/v0.141.0", "source": "security-advisories@github.com"}, {"url": "https://github.com/getkin/kin-openapi/security/advisories/GHSA-mmfr-pmjx-hw9w", "source": "security-advisories@github.com"}, {"url": "https://github.com/getkin/kin-openapi/security/advisories/GHSA-mmfr-pmjx-hw9w", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-476"}]}], "descriptions": [{"lang": "en", "value": "kin-openapi is a Go project for handling OpenAPI files. From 0.10.0 until 0.141.0, openapi3filter.convertParseError in openapi3filter/validation_error_encoder.go dereferences e.Parameter.In without checking whether e.Parameter is nil. A malformed non-string scalar field in a multipart/form-data request body produces a nested ParseError with a nil RequestError.Parameter, and applications that render the validation error through openapi3filter.ConvertErrors or ValidationErrorEncoder panic. An unauthenticated client can repeatedly send such requests to deny service when the application lacks a recovery boundary. JSON request bodies and applications that do not use these error-rendering helpers are not affected. This issue is fixed in version 0.141.0."}, {"lang": "es", "value": "kin-openapi es un proyecto Go para manejar archivos OpenAPI. Desde la versi\u00f3n 0.10.0 hasta la 0.141.0, openapi3filter.convertParseError en openapi3filter/validation_error_encoder.go desreferencia e.Parameter.In sin verificar si e.Parameter es nulo. Un campo escalar no-cadena malformado en un cuerpo de solicitud multipart/form-data produce un ParseError anidado con un RequestError.Parameter nulo, y las aplicaciones que renderizan el error de validaci\u00f3n a trav\u00e9s de openapi3filter.ConvertErrors o ValidationErrorEncoder entran en p\u00e1nico. Un cliente no autenticado puede enviar repetidamente tales solicitudes para denegar el servicio cuando la aplicaci\u00f3n carece de un l\u00edmite de recuperaci\u00f3n. Los cuerpos de solicitud JSON y las aplicaciones que no utilizan estas ayudas de renderizado de errores no se ven afectados. Este problema est\u00e1 corregido en la versi\u00f3n 0.141.0."}], "lastModified": "2026-10-12T16:10:00.220", "sourceIdentifier": "security-advisories@github.com"}