Bug 2521202 (CVE-2026-76905)

Summary: CVE-2026-76905 github.com/getkin/kin-openapi: kin-openapi: Denial of Service via malformed multipart/form-data body
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: akhatavk, akostadi, amasferr, amctagga, anjoseph, ansmith, aoconnor, aos-team-art-private, asdas, asyoung, bniver, crizzo, dfreiber, dhanak, dmayorov, dpaolell, drosa, drow, dsimansk, eglynn, flucifre, gmeno, gparvin, groman, jbritton, jburrell, jdelft, jhollowa, jjoyce, jlledo, jprabhak, jpretori, jsamir, jschluet, jsherril, jupierce, kaycoth, kingland, lchilton, lgarciaa, lhh, mbenjamin, mbiarnes, mburns, mgarciac, mhackett, mnovotny, orabin, pantinor, pjindal, ppalepu, ppostler, prdhamdh, prichard, rhaigner, rhel-process-autobot, rjohnson, rochandr, sausingh, sfeifer, sghai, sidsharm, sostapov, sthirugn, suppawar, tsedmik, vereddy, vkumar, vlaad, watson-tool-maintainers, wtam
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in kin-openapi, a Go project for handling OpenAPI files. An unauthenticated client can exploit this vulnerability by sending a malformed non-string scalar field in a multipart/form-data request body. This can cause applications that render validation errors through specific error-rendering helpers to panic, leading to a Denial of Service (DoS). JSON request bodies and applications that do not use these error-rendering helpers are not affected.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-21 21:01:45 UTC 
kin-openapi is a Go project for handling OpenAPI files. From 0.10.0 until 0.141.0, openapi3filter.convertParseError in openapi3filter/validation_error_encoder.go dereferences e.Parameter.In without checking whether e.Parameter is nil. A malformed non-string scalar field in a multipart/form-data request body produces a nested ParseError with a nil RequestError.Parameter, and applications that render the validation error through openapi3filter.ConvertErrors or ValidationErrorEncoder panic. An unauthenticated client can repeatedly send such requests to deny service when the application lacks a recovery boundary. JSON request bodies and applications that do not use these error-rendering helpers are not affected. This issue is fixed in version 0.141.0.