kin-openapi openapi3filter deepObject Uncontrolled Resource Consumption (DoS)

Vulnerability Overview Vulnerability Name: Uncontrolled resource consumption in openapi3filter deepObject query parameter decoding Description: An uncontrolled resource consumption vulnerability exists in . This vulnerability allows unauthenticated clients to exhaust server resources through multi-gigabyte heap allocations. When a specification declares a -style query parameter whose schema contains an array (a normal, documented schema), the decoder reconstructs the array by reading the largest attacker-provided index and allocating null elements up to that index. Even though schema validation (including ) is never executed, a request as small as 24 bytes ( ) can drive heap allocation to approximately 6.1 GiB, reliably triggering an OOM kill/restart loop on memory-constrained services. Affected Scope Affected Versions: >= 0.124.0 Fixed Version: v0.142.0 CVSS Score: 8.7 / 10 Vulnerability Types: CWE-400, CWE-789 Attack Vector: Network Attack Complexity: Low User Interaction: None Privileges Required: None Exploitability: High Remediation Fixed Version: v0.142.0 Fix Measure: Fixed the query parameter decoding logic in to prevent uncontrolled resource consumption. POC Code Control Test Code `` openapi: "3.0.3" info: {title: t, version: "1.0.0"} paths: /q: get: parameters: - name: param in: query style: deepObject explode: true schema: type: object properties: items: type: array maxItems: 3 items: {type: string} responses: '200': {description: ok} openapi: "3.0.3" info: {title: t, version: "1.0.0"} paths: /o: post: requestBody: content: application/json: schema: type: object properties: items: {type: array, maxItems: 3, items: {type: string}} application/x-www-form-urlencoded: schema: type: object properties: items: {type: array, maxItems: 3, items: {type: string}} multipart/form-data: schema: type: object properties: items: {type: array, maxItems: 3, items: {type: string}} responses: '200': {description: ok} {"items":[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,

Goal Reached Thanks to every supporter — we hit 100%!

kin-openapi openapi3filter deepObject Uncontrolled Resource Consumption (DoS)

More from this source