CVE-2026-76905: 
Chainguard vulnerability analysis and mitigation

CVE-2026-76905 is a NULL pointer dereference vulnerability in kin-openapi (github.com/getkin/kin-openapi), a Go library for handling OpenAPI files. The flaw exists in openapi3filter.convertParseError within openapi3filter/validation_error_encoder.go, where e.Parameter.In is dereferenced without first checking whether e.Parameter is nil. This allows any unauthenticated remote attacker to crash a server by sending a single malformed multipart/form-data HTTP request. Affected versions span from v0.10.0 up to (but not including) v0.141.0; the issue was originally published on July 10, 2026, and added to the GitHub Advisory Database on August 21, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (Github Advisory).

The root cause is a missing nil guard (CWE-476: NULL Pointer Dereference) in the convertParseError function at openapi3filter/validation_error_encoder.go line 120. When a multipart/form-data request body contains a non-string scalar field (e.g., a string value for an integer property), the multipart decoder wraps the resulting *ParseError inside another *ParseError. This nested error shape causes the type assertion on line 119 to succeed, and execution reaches e.Parameter.In == "query" — but for body errors, e.Parameter is always nil (a *RequestError carries either Parameter or RequestBody, never both), triggering a nil pointer dereference and goroutine panic. The sibling "path" branch at line 108 already includes the correct e.Parameter != nil guard; the "query" branch simply omits it. JSON request bodies are not affected because their error shapes either fail the type assertion or are routed through a different code path (convertSchemaError) (Github Advisory, Fix Commit).

Successful exploitation causes the Go handler goroutine to panic with a SIGSEGV (nil pointer dereference), aborting the in-flight request and — absent a recover() boundary in the application's middleware — crashing the request handler. An unauthenticated attacker can repeat this indefinitely to sustain a denial-of-service condition against any affected endpoint. Confidentiality and integrity are not impacted; only availability is affected. The scope is limited to applications that (1) expose endpoints accepting multipart/form-data bodies with at least one non-string scalar property, and (2) render validation errors via the library's ValidationErrorEncoder or ConvertErrors helpers (Github Advisory).

A working proof-of-concept is publicly documented in the GitHub Security Advisory, verified against revision 98d956447b64eaa10d3570a80b3be1a2849945f1 and reproducible on Go 1.25.0. No authentication, special privileges, or unusual client capabilities are required — a single crafted HTTP request is sufficient to trigger the panic. The EPSS score is approximately 0.354% (29th percentile), indicating a relatively low but non-negligible probability of exploitation in the wild within 30 days. There is no current evidence of in-the-wild exploitation or CISA KEV catalog listing (Github Advisory).

1. Identify a target: Locate a Go application using github.com/getkin/kin-openapi versions >= 0.10.0 and < 0.141.0 that exposes an HTTP endpoint accepting multipart/form-data with at least one non-string scalar property (e.g., integer, number, or boolean) and uses ValidationErrorEncoder or ConvertErrors for error rendering.
2. Craft a malformed multipart request: Construct a multipart/form-data HTTP POST request where a scalar field (e.g., age) is given a non-parseable value (e.g., "notanumber" for an integer field).
3. Send the request: Transmit the crafted request to the target endpoint. No authentication headers or special tokens are needed.
4. Trigger the panic: The multipart decoder wraps the parse failure as a nested *ParseError. When the application calls ConvertErrors or ValidationErrorEncoder.Encode, convertParseError dereferences the nil e.Parameter.In field, causing a goroutine panic and aborting the request handler.
5. Sustain DoS: Repeat the request in a loop to continuously deny service to legitimate users, as each request independently triggers the panic (Github Advisory, Fix Commit).

• Network: Repeated HTTP POST requests to endpoints accepting multipart/form-data with scalar fields containing non-parseable values (e.g., alphabetic strings for integer fields); connection resets or HTTP 500 responses from the server following such requests.
• Logs: Application logs showing repeated panic: runtime error: invalid memory address or nil pointer dereference stack traces originating from openapi3filter/validation_error_encoder.go:120; goroutine crash entries referencing convertParseError or ConvertErrors.
• Process: Unexpected Go process restarts or crash-loop behavior in services using kin-openapi; elevated error rates on multipart/form-data endpoints without corresponding legitimate traffic spikes (Github Advisory).

The fix is available in kin-openapi v0.141.0, released July 10, 2026. The patch adds the missing e.Parameter != nil nil guard to the "query" branch in convertParseError, mirroring the existing guard in the "path" branch, and also improves the fallback error message for body parse errors (Fix Commit, v0.141.0 Release). As an interim workaround for applications that cannot immediately upgrade, adding a recover() boundary in the HTTP middleware chain will prevent the panic from crashing the server (though it will still result in a 500 response rather than a proper 400). Applications that do not use ConvertErrors or ValidationErrorEncoder for error rendering, or that only accept application/json bodies, are not affected and do not require immediate action (Github Advisory).

The vulnerability was reported by researcher matiasinsaurralde and credited in the GitHub Security Advisory. A Mastodon post from @thehackerwire noted the disclosure shortly after publication. The advisory was picked up by automated vulnerability tracking services including VulnDB, CVEFeed, INCIBE-CERT, and GitLab's advisory database. No major vendor statements or significant media coverage beyond standard vulnerability aggregation have been observed (Github Advisory).