highCVE-2026-77354Aug 21, 2026

CVE-2026-77354: kin-openapi Uncontrolled Memory Allocation via deepObject Query Parameter

Pranav Khune
Penetration Testing Team Lead, SecureLayer7

A single small HTTP query string can force a Go server using kin-openapi to allocate gigabytes of heap memory, crashing it via OOM kill, because the deepObject decoder blindly pre-allocates a slice…

Packagegithub.com/getkin/kin-openapi
Ecosystemgo
Affected>= 0.124.0, < 0.142.0
Fixed in0.142.0
CVE-2026-77354: kin-openapi Uncontrolled Memory Allocation via deepObject Query Parameter

The problem

The openapi3filter request decoder supports OpenAPI style: deepObject query parameters. When a spec declares such a parameter with an array in its schema, the decoder's sliceMapToSlice function reads the largest index from the query string and allocates a []any covering every position from 0 up to that index.

This allocation happens entirely before schema validation (including maxItems) executes. Any unauthenticated client can trigger hundreds of megabytes to multiple gigabytes of heap allocation with a query string as short as 24 bytes, causing an OOM kill or restart loop on memory-constrained services.

Proof of concept

A working proof-of-concept for CVE-2026-77354 in github.com/getkin/kin-openapi, with the exact payload below.

http
GET /whatever?param[items][50000000]=x HTTP/1.1
Host: victim

The root cause is in sliceMapToSlice (introduced in commit 78bb273, first shipped in v0.124.0): it finds the maximum attacker-supplied integer key, then loops from 0 to that maximum to build a dense slice, filling sparse holes with nil. A second allocation of equal size follows in buildResObj via make([]any, N+1).

The amplification is linear: index 50,000,000 produces ~6.1 GiB of allocation from a 24-byte input (roughly 272,000,000x amplification).

The patch (commit 1223a0f, v0.142.0) adds an upper-bound cap inside sliceMapToSlice that rejects any index exceeding a safe limit before the slice is allocated, so the OOM-triggering loop is never entered. This is CWE-789 (Memory Allocation with Excessive Size Value) combined with CWE-400 (Uncontrolled Resource Consumption).

The fix

Upgrade to github.com/getkin/kin-openapi v0.142.0 or later. The fix is in commit 1223a0f215d2cf9beb2d9eb9ea2649d001c21388. No configuration or spec changes are required. If upgrading immediately is not possible, remove style: deepObject from any query parameter whose schema contains an array, or move those parameters to a request body.

Reporter not attributed.

References: [1][2][3][4]

Related research