# kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing items

kin-openapi's openapi3filter dereferences nil Schema.Items for OpenAPI 3.1 array schemas lacking items, letting one unauthenticated POST panic the handler.

- Payout: Research
- Severity: high
- Program: kin-openapi
- Found by: matiasinsaurralde
- Disclosed: 2026-10-15
- CVE: CVE-2026-97394
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-p6wj-qrr4-pgh5
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-p6wj-qrr4-pgh5
- Tags: area:web domain:api domain:oss impact:dos kind:research platform:ghsa sev:high tech:go technique:parser-differential technique:source-review vuln:dos

**Target:** openapi3filter request/response validation (UrlencodedBodyDecoder, MultipartBodyDecoder, parseArray)
**Root cause:** OpenAPI 3.1 (JSON Schema 2020-12) permits array schemas without items, so doc.Validate() accepts them with Schema.Items == nil; decoders then dereference Items.Value without a nil check.
**Steps:**
1. Define an OpenAPI 3.1 operation with `application/x-www-form-urlencoded` body schema `type: object` property `tags: {type: array}` (no items); doc.Validate() accepts it.
2. Send `POST /f` with `Content-Type: application/x-www-form-urlencoded` and body `tags=a`.
3. UrlencodedBodyDecoder hits `items := propSchema.Value.Items.Value` at req_resp_decoder.go:1421 during schema inspection before parsing, panicking with nil pointer dereference.
4. Same nil Items panics MultipartBodyDecoder (multipart part named like the array property) and parseArray/parsePrimitive (array-typed response headers via ValidateResponse, path/cookie array params).
**How found:** Noticed spec-validation asymmetry: OpenAPI 3.0 rejects array schemas missing items, but 3.1 enables jsonSchema2020ValidationEnabled and skips that check, leaving Schema.Items nil after a clean Validate(); then traced decoder code paths that dereference Items.Value.
**Exploitation:** Any unauthenticated client sends a single non-empty urlencoded (or multipart) POST to an affected operation; the panic is deterministic (50/50, 5/5 E2E) and escapes openapi3filter since Middleware/ValidationHandler call ValidateRequest/ValidateResponse without recover. Stock net/http logs 'http: panic serving' and aborts the connection; handlers without per-request recover can crash the process.
**Insight:** When a library supports multiple spec versions, diff validation rules between versions: a schema legal in the newer version but rejected in the older often leaves fields nil that downstream code assumes populated. Grep decoders for unchecked `.Items.Value`-style dereferences on schema fields.