Hi,

The following vulnerability was published for golang-github-getkin-kin-openapi.

CVE-2026-77354[0]:
| kin-openapi is a Go project for handling OpenAPI files. From 0.124.0
| until 0.142.0, openapi3filter.sliceMapToSlice in
| openapi3filter/req_resp_decoder.go converts attacker-controlled
| sparse indexes from a deepObject query parameter into a dense slice
| by allocating entries from zero through the largest supplied index,
| after which buildResObj creates another slice of the same length.
| This allocation occurs before schema validation, so maxItems does
| not prevent it. An unauthenticated client can send a small query
| such as param[items][50000000]=x to an endpoint whose deepObject
| schema contains an array, forcing multi-gigabyte heap allocation and
| causing an OOM kill or restart loop. Other request-body encodings
| and styled parameters that do not produce bracketed integer indexes
| are not affected. This issue is fixed in version 0.142.0.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-77354
https://www.cve.org/CVERecord?id=CVE-2026-77354
[1] https://github.com/getkin/kin-openapi/pull/923
[2] https://github.com/getkin/kin-openapi/security/advisories/GHSA-xhj3-7xw9-vr34
[3] https://github.com/getkin/kin-openapi/commit/1223a0f215d2cf9beb2d9eb9ea2649d001c21388

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore