GHSA-JPCW-4WR7-C3VQ: Remote Denial of Service via NULL Pointer Dereference in kin-openapi Parameter Validation

Vulnerability ID: GHSA-JPCW-4WR7-C3VQ
CVSS Score: 7.5
Published: 2026-07-24

A NULL pointer dereference vulnerability was discovered in the getkin/kin-openapi Go library. When parsing incoming request parameters that are validated against a content map with an empty media type, the openapi3filter request validation engine attempts to resolve an uninitialized schema pointer. This results in an unhandled Go runtime panic and process termination, yielding an unauthenticated, remote Denial of Service vector.

TL;DR

Unauthenticated remote attackers can crash Go web servers using the kin-openapi validation middleware by sending a request containing a parameter whose media type has no defined schema, triggering a fatal NULL pointer dereference.

⚠️ Exploit Status: POC

Technical Details

• Vulnerability ID: GHSA-JPCW-4WR7-C3VQ
• CWE ID: CWE-476 (Null Pointer Dereference)
• Attack Vector: Network
• CVSS v3.1 Score: 7.5 (High)
• Exploit Status: Proof of Concept (PoC) public
• CISA KEV Status: Not Listed
• Impact: Denial of Service (DoS)

Affected Systems

• getkin/kin-openapi Go library and dependent API gateways/microservices
• kin-openapi: < v0.144.0 (Fixed in: v0.144.0)

Code Analysis

Commit: 68ac2af

Fix openapi3filter parameter content panic when schema is omitted

diff --git a/openapi3filter/req_resp_decoder.go b/openapi3filter/req_resp_decoder.go
index 1234567..89abcde 100644
--- a/openapi3filter/req_resp_decoder.go
+++ b/openapi3filter/req_resp_decoder.go
@@ -194,6 +194,10 @@ func defaultContentParameterDecoder(param *openapi3.Parameter, values []string)
        err = fmt.Errorf("parameter %q has no content schema", param.Name)
        return
    }
+   if mt.Schema == nil {
+       err = fmt.Errorf("parameter %q content media type has no schema", param.Name)
+       return
+   }
    outSchema = mt.Schema.Value

    unmarshal := func(encoded string, paramSchema *openapi3.SchemaRef) (decoded any, err error) {

Mitigation Strategies

• Upgrade kin-openapi dependency to version v0.144.0 or newer
• Verify and audit OpenAPI schema files for parameter content objects without a schema
• Implement Go runtime panic recovery middleware on HTTP handlers

Remediation Steps:

1. Run 'go get github.com/getkin/[email protected]' in the project root
2. Run 'go mod tidy' to update the module dependencies
3. Audit raw specification documents for query, header, or cookie parameters specifying content content maps without nested schema declarations
4. Implement a central recovery block to ensure service survivability

References

• GitHub Security Advisory GHSA-JPCW-4WR7-C3VQ
• Fix Commit in kin-openapi
• v0.144.0 Release Notes

Read the full report for GHSA-JPCW-4WR7-C3VQ on our website for more details including interactive diagrams and full exploit analysis.