High [CVE-2026-77354] Denial of Service via uncontrolled resource consumption in deepObject query parameter decoding
This high-severity Red Hat Linux advisory covers CVE-2026-77354 affecting Migration Toolkit for Applications 8, Multicluster Global Hub, OpenShift Serverless.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
kin-openapi is a Go project for handling OpenAPI files.
From 0.124.0 until 0.142.0, openapi3filter.sliceMapToSlice in openapi3filter/req_resp_decoder.go converts attacker-controlled sparse indexes from a deepObject query parameter into a dense slice by allocating entries from zero through the largest supplied index, after which buildResObj creates another slice of the same length.
This allocation occurs before schema validation, so maxItems does not prevent it. An unauthenticated client can send a small query such as param[items][50000000]=x to an endpoint whose deepObject schema contains an array, forcing multi-gigabyte heap allocation and causing an OOM kill or restart loop.
Other request-body encodings and styled parameters that do not produce bracketed integer indexes are not affected. This issue is fixed in version 0.142.0.
An unauthenticated client can exploit this vulnerability by sending a specially crafted query with a large index in a deepObject query parameter. This forces the application to allocate multi-gigabyte memory, leading to an Out-of-Memory (OOM) error or a restart loop, effectively causing a Denial of Service (DoS).
Red Hat rates this flaw as Important because a small request can exhaust memory and terminate an exposed service.
- 0.124.0
Official advisory · high-confidence parse· fetched 1 hour ago·verify at source
Mitigation
Upgrade to a fixed release: 0.142.0. That is the remediation for this advisory.
The vendor advisory may list additional interim mitigations or workarounds not captured here — review it before change work.
Official advisory · high-confidence parse· fetched 1 hour ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.