A denial of service vulnerability in the getkin kin-openapi library allows remote attackers to crash applications by triggering a null pointer dereference.

This vulnerability is a null pointer dereference flaw that occurs during the processing of OpenAPI files, which can be triggered by unauthenticated remote attackers.

The primary impact of this vulnerability is a denial of service, where an attacker can crash any application relying on the affected kin-openapi library by submitting a malicious OpenAPI file. With a CVSS score of 7.5, this high severity flaw poses a risk to service availability for any infrastructure that parses user supplied API definitions. Frequent service interruptions can significantly impact business operations and reliability.

Immediate Action: Update the kin-openapi dependency to version 0.141.0 or later within your Go projects.

Proactive Monitoring: Monitor application logs for unexpected crashes or panic events associated with API definition parsing.

Compensating Controls: Validate and sanitize all user supplied OpenAPI files against a strict schema before passing them to the kin-openapi library for processing.

Public Exploit Available: No (no confirmed public exploit)

Developers should immediately upgrade to kin-openapi version 0.141.0 to resolve this vulnerability. Protecting against denial of service is essential for maintaining the availability of services that utilize automated API documentation and validation.