Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
getkin/kin-openapi
master @ e56b2a1
3
Fixes
1
CVEs
HIGH
Peak severity
Highlights
Denial of Service: 2 prior fixes. Scrutinize any change in this area.
openapi3filter: most-fixed (2 issues). Treat as high-risk during review.
0 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Denial of Service: Processing untrusted multipart/form-data ZIP archives using default body decoders allows attackers to cause resource exhaustion (zip bomb attacks). This is a known risk tracked by CVE-2025-30153.
Auth Bypass: Validation of x-www-form-urlencoded payloads can be bypassed if nested schema constructs (allOf/anyOf/oneOf) are not recursively decoded, allowing arbitrary unvalidated inputs to pass authorization and validation checks.
Denial of Service: Processing malformed OpenAPI conversion schemas containing nested array types with nil schema references can trigger a nil pointer dereference and cause the application to panic and crash.