CVE-2026-76905

A flaw was found in kin-openapi, a Go project for handling OpenAPI files. An unauthenticated client can exploit this vulnerability by sending a malformed non-string scalar field in a multipart/form-data request body. This can cause applications that render validation errors through specific error-rendering helpers to panic, leading to a Denial of Service (DoS). JSON request bodies and applications that do not use these error-rendering helpers are not affected.

Red Hat scores A:L because the panic occurs inside an HTTP handler goroutine where Go's net/http automatically recovers it. Only the individual request fails; the server continues serving. The CNA scores A:H based on the theoretical case of no recovery boundary.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.