kin-openapi is a Go project for handling OpenAPI files. From 0.124.0 until 0.142.0, openapi3filter.sliceMapToSlice in openapi3filter/req_resp_decoder.go converts attacker-controlled sparse indexes from a deepObject query parameter into a dense slice by allocating entries from zero through the largest supplied index, after which buildResObj creates another slice of the same length. This allocation occurs before schema validation, so maxItems does not prevent it. An unauthenticated client can send a small query such as param[items][50000000]=x to an endpoint whose deepObject schema contains an array, forcing multi-gigabyte heap allocation and causing an OOM kill or restart loop. Other request-body encodings and styled parameters that do not produce bracketed integer indexes are not affected. This issue is fixed in version 0.142.0.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - kin-openapi is a Go project for handling OpenAPI files. From 0.124.0 until 0.142.0,
    openapi3filter.sliceMapToSlice in openapi3filter/req_resp_decoder.go converts attacker-controlled sparse
    indexes from a deepObject query parameter into a dense slice by allocating entries from zero through the
    largest supplied index, after which buildResObj creates another slice of the same length. This allocation
    occurs before schema validation, so maxItems does not prevent it. An unauthenticated client can send a
    small query such as param[items][50000000]=x to an endpoint whose deepObject schema contains an array,
    forcing multi-gigabyte heap allocation and causing an OOM kill or restart loop. Other request-body
    encodings and styled parameters that do not produce bracketed integer indexes are not affected. This issue
    is fixed in version 0.142.0. (CVE-2026-77354)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - kin-openapi is a Go project for handling OpenAPI files. From 0.124.0 until 0.142.0,     openapi3filter.sliceMapToSlice in openapi3filter/req_resp_decoder.go converts attacker-controlled sparse     indexes from a deepObject query parameter into a dense slice by allocating entries from zero through the     largest supplied index, after which buildResObj creates another slice of the same length. This allocation     occurs before schema validation, so maxItems does not prevent it. An unauthenticated client can send a     small query such as param[items][50000000]=x to an endpoint whose deepObject schema contains an array,     forcing multi-gigabyte heap allocation and causing an OOM kill or restart loop. Other request-body     encodings and styled parameters that do not produce bracketed integer indexes are not affected. This issue     is fixed in version 0.142.0. (CVE-2026-77354)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
446230	SCA: security update for github.com/getkin/kin-openapi (GHSA-xhj3-7xw9-vr34)	Tenable Cloud Security	SCA Checks	Local	high
446230	SCA: security update for github.com/getkin/kin-openapi (GHSA-xhj3-7xw9-vr34)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
338846	Linux Distros Unpatched Vulnerability : CVE-2026-77354	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-77354

high

Tenable Plugins

high

high

high