GHSA-jpcw-4wr7-c3vq: kin-openapi openapi3filter: unauthenticated nil-pointer panic when validating a request against a `content` parameter whose media type has no schema

| Field | Value | |---|---| | Ecosystem | Go | | Package | github.com/getkin/kin-openapi | | Affected versions | <= 0.143.0 (introduced in v0.2.0, PR #90, 2019-05-07; reproduced on HEAD 30e2923) | | Patched versions | 0.144.0 | Summary openapi3filter.ValidateRequest contains a NULL-pointer-dereference denial of service: any unauthenticated client can crash the request-validation path with a single HTTP request. When an operation declares a content parameter (as opposed to a schema parameter) whose media type object has no schema, request validation dereferences that missing schema and panics. The document is legal under the OpenAPI Specification — kin-openapi's own doc.Validate() accepts it — and the defect affects both OpenAPI 3.0.x and 3.1.x. Depending on how the library is wired into the server (see Impact), this ranges from a per-request abort with unbounded panic-log growth to a full remote process crash. Details The decoder used for content parameters when no custom ParamDecoder is configured (the library default), defaultContentParameterDecoder, dereferences the media-type schema without a nil check. openapi3filter/req_resp_decoder.go, around line 197: mt := content.Get("application/json") if mt == nil { // media-type OBJECT is guarded ... err = fmt.Errorf("parameter %q has no content schema", param.Name) return } outSchema = mt.Schema.Value // ... but mt.Schema is NOT — panics when nil The function guards param.Content == nil, len(content) != 1, and mt == nil, but never mt.Schema == nil. Why a schema-less content parameter is legal (so the sink is reachable — doc.Validate() returns no error), in both 3.0.x and 3.1.x: - openapi3/parameter.go — Parameter.Validate only enforces *exactly one of schema XOR content*; a parameter with content (and no schema) satisfies it. - openapi3/media_type.go — MediaType.Validate validates the schema only when it is non-nil, so an absent schema is not a validation error. Call path to the panic: ValidateRequest openap