CVE-2026-77354
Summary
An uncontrolled resource consumption vulnerability in openapi3filter lets any unauthenticated client force multi-gigabyte heap allocation with a single, tiny HTTP request. When a spec declares a deepObject-style query parameter whose schema contains an array (a normal, documented pattern), the decoder reconstructs the array by reading the largest attacker-supplied index and allocating one slot for every position from 0 up to that index — *before* schema validation (including maxItems) ever runs. A request as small as 24 bytes (?param[items][50000000]=x) drives heap allocation to ~6.1 GiB, reliably triggering an OOM kill / restart loop on memory-constrained services.
Details
The OpenAPI style: deepObject serialization lets clients express arrays in the query string using bracket notation, e.g. param[items][0]=a¶m[items][1]=b. The decoder first collects these into an intermediate map[string]any keyed by the string of the index, then converts that sparse map into a real []any in sliceMapToSlice:
// req_resp_decoder.go (vulnerable version)
func sliceMapToSlice(m map[string]any) ([]any, error) {
var result []any
keys := make([]int, 0, len(m))
for k := range m {
key, err := strconv.Atoi(k) // "50000000" -> 50000000, attacker-controlled
if err != nil {
return nil, fmt.Errorf("array indexes must be integers: %w", err)
}
keys = append(keys, key)
}
max := -1
for _, k := range keys {
if k > max {
max = k // max = attacker's index, unbounded
}
}
for i := 0; i <= max; i++ { // <-- unbounded loop, 0 .. max
val, ok := m[strconv.Itoa(i)]
if !ok {
result = append(result, nil) // fills every sparse hole with nil
continue
}
result = append(result, val)
}
return result, nil
}
A second, equally-sized allocation follows immediately in buildResObj:
resultArr := make([]any /*not 0,*/, len(arr)) // second allocation, size = max+1
for i := range arr {
r, err := buildResObj(params, mapKeys, strconv.Itoa(i), schema.Value.Items)
...
}
So a single attacker-chosen integer N pro
⚡ Watch CVE-2026-77354
Get an email if CVE-2026-77354 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.30% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 22% of all EPSS-scored CVEs.
Advisory coverage (2)
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-77354)