Hi,

The following vulnerability was published for golang-github-getkin-kin-openapi.

CVE-2026-76905[0]:
| kin-openapi is a Go project for handling OpenAPI files. From 0.10.0
| until 0.141.0, openapi3filter.convertParseError in
| openapi3filter/validation_error_encoder.go dereferences
| e.Parameter.In without checking whether e.Parameter is nil. A
| malformed non-string scalar field in a multipart/form-data request
| body produces a nested ParseError with a nil RequestError.Parameter,
| and applications that render the validation error through
| openapi3filter.ConvertErrors or ValidationErrorEncoder panic. An
| unauthenticated client can repeatedly send such requests to deny
| service when the application lacks a recovery boundary. JSON request
| bodies and applications that do not use these error-rendering
| helpers are not affected. This issue is fixed in version 0.141.0.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-76905
https://www.cve.org/CVERecord?id=CVE-2026-76905
[1] https://github.com/getkin/kin-openapi/security/advisories/GHSA-mmfr-pmjx-hw9w
[2] https://github.com/getkin/kin-openapi/commit/1d0a337c9b1570fab283be8a04c8af6e43b9a22c

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore