Threats tagged 'ghsa-rj39-cv6w-8wv7'

kin-openapi versions prior to 0.148.0 improperly handle unusual numeric values such as YAML NaN and infinity during OpenAPI 3.1 validation. This flaw allows a remote unauthenticated client to send specially crafted YAML request bodies containing .nan, .inf, or -.inf values, triggering a panic in the dependency jsonschema v6.0.2. The panic occurs due to dereferencing a nil big.Rat during request validation, which can cause process termination in some hosting environments. The issue is fixed in version 0.148.0.