SB2026073075 - Multiple vulnerabilities in kin-openapi

Description

This security bulletin contains information about 2 vulnerabilities.

1) NULL pointer dereference (CVE-ID: N/A)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a nil-pointer dereference in the openapi3 spec loader when parsing a crafted self-referential additionalProperties $ref in an OpenAPI document. A remote attacker can submit a specially crafted OpenAPI specification to cause a denial of service.

The issue is triggered during spec loading before validation.

2) Input validation error (CVE-ID: N/A)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in the openapi3filter legacy router when handling requests to an existing static path with a non-canonical or unsupported HTTP method. A remote attacker can send a specially crafted request to cause a denial of service.

The panic occurs during route resolution before authentication runs, and exploitation requires the target path to be an exact static path defined in the served specification.

Remediation

Install update from vendor's website.

References

• https://github.com/getkin/kin-openapi/security/advisories/GHSA-mh7x-f8wq-4jhx
• https://github.com/getkin/kin-openapi/security/advisories/GHSA-fh4f-47mf-f2gj