CVE-2026-73502 getkin CVE debrief

Who should care

Defenders responsible for systems using kin-openapi, particularly those in Go-based deployments, should assess exposure and apply the patch to prevent potential service disruptions.

Why it matters

CVE-2026-73502 is a medium-severity denial-of-service vulnerability in kin-openapi that can cause service disruptions with a single unauthenticated request. Defenders should assess exposure, prioritize patching, and monitor for exploitation attempts.

• Potential service disruption due to request validation panics.
• Increased log growth in synchronous net/http paths.
• Possible process crashes in integrations without recovery mechanisms.
• Verification of system resilience against crafted requests.

Technical summary

The kin-openapi project is vulnerable to a denial-of-service attack due to a NULL-pointer-dereference in the openapi3filter.ValidateRequest function. This occurs when an operation declares a content parameter with an application/json media type that has no schema. An attacker can exploit this by sending a single unauthenticated request with the parameter value, causing the request validation to panic and potentially leading to a service disruption or process crash.

Defensive priority

Defenders should prioritize assessing exposure and applying the patch, as this vulnerability can cause service disruption with a single unauthenticated request.

Recommended defensive actions

• Assess exposure by checking if systems using kin-openapi are within affected versions (0.2.0 to 0.143.0).
• Apply the patch by updating kin-openapi to version 0.144.0 or later.
• Monitor for unusual request validation failures or process crashes indicating potential exploitation attempts.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. However, the scope of affected deployments and potential impact on specific systems require further verification.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.