Medium [CVE-2026-76905] Denial of Service via malformed multipart/form-data body
This medium-severity Red Hat Linux advisory covers CVE-2026-76905 affecting Migration Toolkit for Applications 8, Multicluster Engine for Kubernetes, Multicluster Global Hub.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
kin-openapi is a Go project for handling OpenAPI files. From 0.10.0 until 0.141.0, openapi3filter.convertParseError in openapi3filter/validation_error_encoder.go dereferences e.Parameter.In without checking whether e.Parameter is nil.
A malformed non-string scalar field in a multipart/form-data request body produces a nested ParseError with a nil RequestError. Parameter, and applications that render the validation error through openapi3filter.
ConvertErrors or ValidationErrorEncoder panic. An unauthenticated client can repeatedly send such requests to deny service when the application lacks a recovery boundary.
JSON request bodies and applications that do not use these error-rendering helpers are not affected. This issue is fixed in version 0.141.0.
This can cause applications that render validation errors through specific error-rendering helpers to panic, leading to a Denial of Service (DoS). Red Hat scores A:L because the panic occurs inside an HTTP handler goroutine where Go's net/http automatically recovers it.
Only the individual request fails; the server continues serving. The CNA scores A:H based on the theoretical case of no recovery boundary.
Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Weakness: CWE-476.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
- 0.141.0
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
Mitigation
Upgrade to a fixed release: 0.141.0. That is the remediation for this advisory.
The vendor advisory may list additional interim mitigations or workarounds not captured here — review it before change work.
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.