GO-2026-6274

kin-openapi openai3filter: nil-pointer panic in ConvertErrors on malformed multipart/form-data body enables unauthenticated DoS in github.com/getkin/kin-openapi

At a glance

Published: 2026-08-25 15:00 UTC
Updated: 2026-09-02 16:10 UTC
CVE: CVE-2026-76905
Aliases: GHSA-mmfr-pmjx-hw9w

Description

kin-openapi openai3filter: nil-pointer panic in ConvertErrors on malformed multipart/form-data body enables unauthenticated DoS in github.com/getkin/kin-openapi

Affected packages

Package	Versions
Go · github.com/getkin/kin-openapi	introduced 0.10.0, fixed 0.141.0

References

https://github.com/getkin/kin-openapi/security/advisories/GHSA-mmfr-pmjx-hw9w ADVISORY
https://github.com/getkin/kin-openapi/commit/1d0a337c9b1570fab283be8a04c8af6e43b9a22c FIX
https://github.com/getkin/kin-openapi/releases/tag/v0.141.0 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — Go Vulnerability Database