Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/getkin/kin-openapi | go | >= 0.10.0, < 0.141.0 | 0.141.0 |
Miggo AIRoot Cause AnalysisThe vulnerability is a nil-pointer dereference in the convertParseError function, located in openapi3filter/validation_error_encoder.go. This occurs when the system processes a validation error from a malformed multipart/form-data request body. The ValidateRequest function generates a RequestError where the Parameter field is nil for request body errors. This error is then passed to ConvertErrors, which calls convertParseError. Inside convertParseError, the code attempts to access e.Parameter.In without first checking if e.Parameter is nil. This access causes a panic, which can be triggered by an unauthenticated attacker to cause a denial of service. The fix involves adding a e.Parameter != nil check to prevent the dereference. The functions convertParseError and its caller ConvertErrors are directly involved in the panic, as shown in the stack trace. ValidateRequest is the entry point for the validation that produces the problematic error.
github.com/getkin/kin-openapi/openapi3filter.convertParseErroropenapi3filter/validation_error_encoder.go
github.com/getkin/kin-openapi/openapi3filter.ConvertErrorsopenapi3filter/validation_error_encoder.go
github.com/getkin/kin-openapi/openapi3filter.ValidateRequestopenapi3filter/validate_request.go