CVE-2026-77354: 
Chainguard vulnerability analysis and mitigation

CVE-2026-77354 is an uncontrolled resource consumption vulnerability in kin-openapi (Go module github.com/getkin/kin-openapi), a Go library for handling OpenAPI files. The flaw exists in openapi3filter's deepObject query parameter decoder and allows any unauthenticated remote client to force multi-gigabyte heap allocation with a single, tiny HTTP request. It affects versions >= 0.124.0 and < 0.142.0, and was first published on July 11, 2026, with the advisory added to the GitHub Advisory Database on August 21, 2026. The vulnerability carries a CVSS v4 base score of 8.7 (High) (Github Advisory, Security Advisory).

The root cause is classified as CWE-400 (Uncontrolled Resource Consumption) and CWE-789 (Memory Allocation with Excessive Size Value). The vulnerable function sliceMapToSlice in openapi3filter/req_resp_decoder.go converts a sparse map of attacker-controlled integer indexes (from a deepObject query parameter) into a dense []any slice by allocating entries from index 0 through the largest supplied index — before any schema validation (including maxItems) runs. A second equally-sized allocation then occurs in buildResObj. Because the index is parsed via strconv.Atoi with no upper bound check, a 24-byte query string such as ?param[items][50000000]=x forces ~6.1 GiB of heap allocation. The vulnerable code path was introduced in commit 78bb273 (merged March 22, 2024, first shipped in v0.124.0) and is exclusively triggered via style: deepObject query parameters whose schema contains an array; JSON bodies, URL-encoded forms, multipart, and other parameter styles are unaffected (Security Advisory, Fix Commit).

Successful exploitation results in a denial-of-service condition: a single unauthenticated HTTP GET request can exhaust the Go process heap, triggering an OOM kill and service restart loop. A handful of concurrent such requests reliably exhausts memory on typical container deployments (256 MB–2 GB limits). There is no confidentiality or integrity impact — the vulnerability is purely an availability attack against any service using openapi3filter to validate requests against a spec with a deepObject-style array-bearing query parameter (Github Advisory, Security Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the advisory date (Github Advisory). The vulnerability requires no authentication, no special headers, no request body, and no credentials — only a crafted query string targeting an endpoint whose OpenAPI spec uses style: deepObject with an array schema. The EPSS score is approximately 0.302% (23rd percentile), indicating a low but non-negligible probability of exploitation in the near term. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. No threat actor attribution is available.

1. Reconnaissance: Identify services that use github.com/getkin/kin-openapi versions >= 0.124.0 and < 0.142.0 for OpenAPI request validation. Review the target's OpenAPI spec (often publicly exposed at /openapi.json or /swagger.json) for any query parameter with style: deepObject and a schema containing a type: array property.
2. Identify target endpoint: Locate an API endpoint (e.g., GET /q) whose spec declares a deepObject query parameter (e.g., param) with an array-typed property (e.g., items).
3. Craft the malicious request: Construct a minimal HTTP GET request with a large bracketed integer index in the query string. No body, authentication, or special headers are required:

GET /q?param[items][50000000]=x HTTP/1.1
Host: victim

4. Trigger heap exhaustion: The server's openapi3filter.ValidateRequest call processes the query parameter, invoking sliceMapToSlice, which allocates a ~50-million-element slice before schema validation runs — consuming ~6.1 GiB of heap.
5. Achieve denial of service: The Go process is OOM-killed by the OS or container runtime and enters a restart loop. Sending a small number of concurrent requests amplifies the effect, preventing service recovery (Security Advisory, Github Advisory).

• Network: Unusual HTTP GET requests to API endpoints with query parameters matching the pattern param[<name>][<large_integer>]=<value> (e.g., param[items][50000000]=x); repeated requests of this form from the same or multiple source IPs.
• Logs: Application or web server access logs showing GET requests with bracketed integer query parameters containing very large index values (e.g., [1000000], [50000000]); error log entries referencing maximum number of items validation failures immediately following such requests.
• Process/System: Sudden spikes in Go process heap memory usage (hundreds of MiB to several GiB) followed by OOM kill events in system logs (dmesg, journalctl, or container runtime logs); repeated service restarts or crash-loop-backoff events in orchestration platforms (e.g., Kubernetes pod restart counts increasing rapidly).
• Container/OS: OOM killer events in kernel logs (Out of memory: Kill process) correlated with the Go service process; container memory limit exceeded events in orchestration logs.

The primary remediation is to upgrade github.com/getkin/kin-openapi to version v0.142.0 or later, which introduces a maxSliceMapToSliceGap constant (set to 10,000) in sliceMapToSlice to reject inputs where the gap between supplied elements and the reconstructed slice size is too large, and also rejects negative indexes (Fix Commit, v0.142.0 Release). As interim mitigations, deploy rate limiting and request throttling on API endpoints that accept deepObject query parameters, and enforce memory limits with automatic restart monitoring to reduce the blast radius of OOM events. Disabling deepObject-style query parameter validation in the OpenAPI spec (if not functionally required) also eliminates the attack surface.