Technical impact
The vulnerability is an uncontrolled allocation of slice memory in the openapi3filter library when decoding deepObject style query parameters. An attacker can supply a sparse index list such as param[items][50000000]=x, causing the decoder to allocate a dense slice of that length before schema validation. This forces the process to reserve several gigabytes of heap space, which can trigger an OOM kill or restart loop. The CVSS score of 8.7 classifies it as high impact, indicating a risk to availability and potential denial‑of‑service. The weakness is listed as CWE‑1285, CWE‑400, and CWE‑789, underscoring the lack of input size validation and memory consumption issues.
Affected Systems
The affected product is getkin:kin-openapi, a Go library for handling OpenAPI files. Versions from 0.124.0 up to but not including 0.142.0 are vulnerable. The issue is fixed in version 0.142.0 and later, so any deployment using these ranges is at risk.
Risk and Exploitability
The CVSS score of 8.7 indicates a high impact, while the EPSS score of 0.00302 (~0.3%) shows a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an unauthenticated network client sending a crafted query to any endpoint that accepts deepObject parameters. Successful exploitation can exhaust system memory, leading to application termination or repeated restarts, and thereby causing a denial‑of‑service condition. No authentication or privileged prerequisites are required beyond the ability to access the endpoint.
Github GHSA