The kin-openapi Go project versions >=0.124.0 and <0.142.0 contain an uncontrolled resource consumption vulnerability (CWE-400) in the openapi3filter.sliceMapToSlice function. This function converts sparse indexes from deepObject query parameters into dense slices by allocating memory from zero through the largest index before schema validation occurs. Because maxItems schema validation is not applied before allocation, an attacker can send a query parameter with a very large index (e.g., param[items][50000000]=x), forcing the application to allocate multi-gigabyte slices. This can cause out-of-memory kills or restart loops, impacting availability. The vulnerability does not affect other request-body encodings or styled parameters that do not produce bracketed integer indexes. The issue is resolved in kin-openapi version 0.142.0.

An unauthenticated attacker can cause a denial of service by triggering excessive memory allocation through crafted deepObject query parameters. This can lead to out-of-memory conditions, process termination, or restart loops, resulting in service unavailability. There is no indication of data confidentiality or integrity impact. The vulnerability affects availability only.

Upgrade kin-openapi to version 0.142.0 or later, where this uncontrolled resource consumption issue is fixed. Until upgrading, consider implementing input validation or limiting query parameter sizes at the application or infrastructure level to mitigate exploitation risk. Patch status is not explicitly stated as 'official-fix' in the vendor advisory, but the fix is included in version 0.142.0 as per the description.