# kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter

Three unpatched nil-`items` array paths in kin-openapi's openapi3filter (query, deepObject, allOf urlencoded body) let an unauthenticated request panic request validation.

- Payout: Research
- Severity: high
- Program: kin-openapi
- Found by: eros938, hash3liZer
- Disclosed: 2026-10-15
- CVE: CVE-2026-100353
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-vrcc-3ch7-hppw
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-vrcc-3ch7-hppw
- Tags: area:web domain:api domain:oss impact:dos kind:research platform:ghsa sev:high tech:go technique:incomplete-fix technique:regression technique:source-review vuln:dos

**Target:** openapi3filter request validation (query params, deepObject, urlencoded body)
**Root cause:** `urlValuesDecoder.parseArray` and the `buildResObj` array branch dereference `schema.Value.Items` without a nil check, and the prior fix only guarded top-level properties, missing query params, deepObject recursion, and allOf/anyOf/oneOf sub-schemas.
**Steps:**
1. Declare an OAS 3.1 spec with a query param `ids` of `type: array` and no `items`; `doc.Validate()` accepts it.
2. Send `GET /test?ids=1&ids=2` through `openapi3filter.ValidateRequest`; `parseArray` passes nil `Items` to `parseValue`, which dereferences it at `schema.Value.AllOf`.
3. For deepObject: declare param `filter` with array property `tags` lacking `items`, send `GET /test?filter[tags][0]=a`; `buildResObj` recurses with nil `Items`.
4. For body: declare urlencoded body with array property `tags` inside an `allOf` sub-schema, send `POST /submit` body `tags=a&tags=b`; `decodeSchemaConstructs` walks allOf and reaches unguarded `parseArray`.
5. Fix: add nil-`items` guards to `urlValuesDecoder.parseArray` and the `buildResObj` array branch.
**How found:** Reviewed the GHSA-p6wj-qrr4-pgh5 fix, noticed guards were added only to standalone `parseArray`, top-level `UrlencodedBodyDecoder` loop, and `MultipartBodyDecoder`, then traced other callers of `urlValuesDecoder.parseArray` and the `buildResObj` recursion to find unguarded paths.
**Exploitation:** Unauthenticated attacker sends one crafted request matching a spec that legally omits `items`; validation panics. Under net/http the panic is recovered per-connection (per-request DoS); under fasthttp/connect adapters or app-spawned goroutines the process crashes (full DoS).
**Insight:** When auditing a nil-deref fix, enumerate every call site of the shared decoder helper rather than the patched entry points; recursive schema walkers (allOf/anyOf/oneOf, deepObject) bypass top-level property guards.