kin-openapi is a Go project for handling OpenAPI files. From 0.10.0 until 0.141.0, openapi3filter.convertParseError in openapi3filter/validation_error_encoder.go dereferences e.Parameter.In without checking whether e.Parameter is nil. A malformed non-string scalar field in a multipart/form-data request body produces a nested ParseError with a nil RequestError.Parameter, and applications that render the validation error through openapi3filter.ConvertErrors or ValidationErrorEncoder panic. An unauthenticated client can repeatedly send such requests to deny service when the application lacks a recovery boundary. JSON request bodies and applications that do not use these error-rendering helpers are not affected. This issue is fixed in version 0.141.0.

A denial-of-service vulnerability exists in the kin-openapi Go library (versions 0.10.0 through 0.140.x) due to a nil pointer dereference in openapi3filter/validation_error_encoder.go. The function convertParseError dereferences e.Parameter.In without first verifying that e.Parameter is non-nil. A malformed non-string scalar field in a multipart/form-data request body triggers a nested ParseError with a nil RequestError.Parameter, causing applications using openapi3filter.ConvertErrors or ValidationErrorEncoder to panic. An unauthenticated remote attacker can repeatedly send such crafted requests to exhaust service availability when no recovery boundary (e.g., panic recovery middleware) is in place. JSON request bodies and applications not using the affected error-rendering helpers are not impacted. The vulnerability is fixed in version 0.141.0 of kin-openapi.