CVE-2026-77354

A flaw was found in kin-openapi, a Go project for handling OpenAPI files. An unauthenticated client can exploit this vulnerability by sending a specially crafted query with a large index in a deepObject query parameter. This forces the application to allocate multi-gigabyte memory, leading to an Out-of-Memory (OOM) error or a restart loop, effectively causing a Denial of Service (DoS).

Red Hat rates this flaw as Important because a small request can exhaust memory and terminate an exposed service. Exploitation requires an application to decode attacker-controlled query parameters using kin-openapi’s deepObject handling with an array-containing schema. Schema limits such as maxItems do not prevent the allocation, and HTTP handler panic recovery does not protect against process termination from memory exhaustion.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.