kin-openapi, a Go library for handling OpenAPI files, has a NULL pointer dereference vulnerability (CWE-476) in versions >=0.10.0 and <0.141.0. The function openapi3filter.convertParseError dereferences e.Parameter.In without verifying that e.Parameter is non-nil. When a malformed non-string scalar field is sent in a multipart/form-data request body, it produces a nested ParseError with a nil RequestError.Parameter. Applications that render validation errors using openapi3filter.ConvertErrors or ValidationErrorEncoder will panic, potentially causing a denial of service. JSON request bodies and applications not using these error-rendering helpers are not affected. The issue is resolved in version 0.141.0.

An unauthenticated attacker can send specially crafted multipart/form-data requests that trigger a NULL pointer dereference, causing the application to panic and potentially crash if it lacks proper recovery boundaries. This results in a denial of service condition. There is no impact on confidentiality or integrity. The vulnerability does not affect JSON request bodies or applications that do not use the vulnerable error-rendering helpers.

Upgrade kin-openapi to version 0.141.0 or later, where this NULL pointer dereference issue is fixed. If upgrading is not immediately possible, ensure that the application has proper recovery boundaries to handle panics gracefully and avoid service disruption. No other mitigations are specified.