The kin-openapi library is vulnerable to a denial-of-service attack due to uncontrolled memory allocation when handling malicious or malformed OpenAPI files.

This vulnerability (CWE-400 and CWE-789) involves uncontrolled resource consumption and memory allocation with excessive size values. The attack is network-based and does not require authentication or user interaction, allowing for remote exploitation.

The CVSS score of 8.7 highlights a critical risk of service disruption. An attacker can submit specially crafted OpenAPI files to trigger excessive memory consumption, which will likely lead to an application crash or system-wide resource exhaustion, resulting in significant service downtime.

Immediate Action: Update the kin-openapi library to version 0.142.0 or later.

Proactive Monitoring: Monitor application memory usage and process health for spikes that may indicate attempts to exploit resource allocation flaws.

Compensating Controls: Implement strict input validation and size limits on all incoming files or data payloads before they are processed by the OpenAPI parser.

Public Exploit Available: No (unknown)

Given the potential for remote denial-of-service attacks, upgrading to the patched version of kin-openapi is critical. Security teams should ensure that all downstream dependencies are also updated to maintain the stability and availability of their applications.