CVE-2026-76905: CWE-476: NULL Pointer Dereference in getkin kin-openapi

kin-openapi, a Go library for handling OpenAPI files, contains a NULL pointer dereference vulnerability (CWE-476) in the openapi3filter.convertParseError function located in openapi3filter/validation_error_encoder.go. Between versions 0.10.0 and 0.141.0, the code dereferences e.Parameter.In without verifying if e.Parameter is nil. When a malformed non-string scalar field is sent in a multipart/form-data request body, a nested ParseError is generated with a nil RequestError.Parameter. Applications that use openapi3filter.ConvertErrors or ValidationErrorEncoder to render validation errors will panic, potentially causing a denial of service. JSON request bodies and applications not using these error-rendering helpers are not affected. The vulnerability is resolved in version 0.141.0.

An unauthenticated attacker can cause a denial of service by sending specially crafted multipart/form-data requests that trigger a NULL pointer dereference in affected kin-openapi versions. This leads to application panics if the application uses the vulnerable error rendering helpers and lacks recovery boundaries. There is no impact on confidentiality or integrity, only availability.

Upgrade kin-openapi to version 0.141.0 or later, where this issue is fixed. Until then, applications should avoid using openapi3filter.ConvertErrors or ValidationErrorEncoder with untrusted multipart/form-data inputs or implement recovery boundaries to handle panics gracefully. Patch status is confirmed fixed in 0.141.0.