Bug 2518119 (CVE-2026-73502)

Summary:	CVE-2026-73502 github.com/getkin/kin-openapi: kin-openapi: Denial of Service via unauthenticated nil-pointer dereference
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	akhatavk, akostadi, amasferr, amctagga, anjoseph, ansmith, aoconnor, aos-team-art-private, asdas, asyoung, bniver, crizzo, dfreiber, dhanak, dmayorov, dpaolell, drosa, drow, dsimansk, eglynn, flucifre, gmeno, gparvin, groman, jbritton, jburrell, jdelft, jhollowa, jjoyce, jlledo, jprabhak, jpretori, jsamir, jschluet, jsherril, jupierce, kaycoth, kingland, lchilton, lgarciaa, lhh, mbenjamin, mbiarnes, mburns, mgarciac, mhackett, mnovotny, orabin, pantinor, pjindal, ppalepu, ppostler, prdhamdh, prichard, rhaigner, rhel-process-autobot, rjohnson, rochandr, sausingh, sfeifer, sghai, sidsharm, sostapov, sthirugn, suppawar, tsedmik, vereddy, vkumar, vlaad, watson-tool-maintainers, wtam
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in kin-openapi. An unauthenticated remote attacker can trigger a null-pointer dereference in the `openapi3filter.ValidateRequest` function. This occurs when validating a request against a `content` parameter whose `application/json` media type has no schema. Successful exploitation leads to a denial of service, causing request validation to panic and potentially resulting in an aborted request or a full process crash.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-18 18:02:31 UTC

kin-openapi is a Go project for handling OpenAPI files. From 0.2.0 until 0.144.0, openapi3filter.ValidateRequest can encounter a NULL-pointer-dereference denial of service when an operation declares a content parameter whose application/json media type has no schema. In openapi3filter/req_resp_decoder.go, the default defaultContentParameterDecoder dereferences mt.Schema.Value without checking whether mt.Schema is nil, even though doc.Validate() accepts the document under OpenAPI 3.0.x and 3.1.x. A single unauthenticated request supplying the parameter value can panic request validation, causing an aborted request with log growth in the common synchronous net/http path or a full process crash in integrations without recovery. This issue is fixed in version 0.144.0.