Skip to content

fix(deps): update module github.com/getkin/kin-openapi to v0.131.0 [security] #1986

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
jamietanna merged 1 commit into from
Jul 15, 2025
Merged

fix(deps): update module github.com/getkin/kin-openapi to v0.131.0 [security] #1986

jamietanna merged 1 commit into from
Jul 15, 2025

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented May 15, 2025

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
github.com/getkin/kin-openapi v0.128.0 -> v0.131.0 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2025-30153

Summary

When validating a request with a multipart/form-data schema, if the OpenAPI schema allows it, an attacker can upload a crafted ZIP file (e.g., a ZIP bomb), causing the server to consume all available system memory.

Details

The root cause comes from the ZipFileBodyDecoder, which is registered automatically by the module (contrary to what the documentation says.

PoC

To reproduce the vulnerability, you can use the following OpenAPI schema:

openapi: 3.0.0
info:
  title: 'Validator'
  version: 0.0.1
paths:
  /:
    post:
      requestBody:
        required: true
        content:
          multipart/form-data:
            schema:
              type: object
              required:
                - file
              properties:
                file:
                  type: string
                  format: binary
      responses:
        '200':
          description: Created

And this code to validate the request (nothing fancy, it basically only calls the openapi3filter.ValidateRequest function`):

package main

import (
	"fmt"
	"log"
	"net/http"

	"github.com/getkin/kin-openapi/openapi3filter"
	legacyrouter "github.com/getkin/kin-openapi/routers/legacy"

	"github.com/getkin/kin-openapi/openapi3"
)

func handler(w http.ResponseWriter, r *http.Request) {
	loader := openapi3.NewLoader()

	doc, err := loader.LoadFromFile("schema.yaml")
	if err != nil {
		http.Error(w, "Failed to load OpenAPI document", http.StatusInternalServerError)
		return
	}

	if err := doc.Validate(r.Context()); err != nil {
		http.Error(w, "Invalid OpenAPI document", http.StatusBadRequest)
		return
	}

	router, err := legacyrouter.NewRouter(doc)
	if err != nil {
		http.Error(w, "Failed to create router", http.StatusInternalServerError)
		return
	}

	route, pathParams, err := router.FindRoute(r)
	if err != nil {
		http.Error(w, "Failed to find route", http.StatusNotFound)
		return
	}

	input := &openapi3filter.RequestValidationInput{
		Request:     r,
		QueryParams: r.URL.Query(),
		Route:       route,
		PathParams:  pathParams,
	}

	if err := openapi3filter.ValidateRequest(r.Context(), input); err != nil {
		http.Error(w, fmt.Sprintf("Request validation failed: %v", err), http.StatusBadRequest)
		return
	}

	w.Write([]byte("request ok !"))
}

func main() {
	http.HandleFunc("/", handler)
	log.Fatal(http.ListenAndServe(":8080", nil))

}

We also need to create a zip bomb. This command will create a 4.7GB file and compress it to to 4.7MB zip archive:

perl -e 'print "0" x 5000000000' > /tmp/bigfile.txt; zip -9 /tmp/bomb.zip /tmp/bigfile.txt

Run the PoC provided, and upload the zip bomb with curl localhost:8080/ -F file="@​/tmp/bomb.zip;type=application/zip" -v.

Observe the memory consumption of the test server during and after the upload (it jumped to a bit over 22GB in my testing, with only a 4.7MB input file, you can reduce the size of the generated file to not kill your test machine when reproducing.)

Impact

An attacker can trigger an out-of-memory (OOM) condition, leading to server crashes or degraded performance.
It seems to only be exploitable if the OpenAPI schema allows for multipart upload.

Remediation

I see at least 2 potential fixes/improvements:

  • Do not register by default the zip file decoder (I honestly was a bit surprised to see it was enabled by default, it seems to be quite a niche use-case ?)
  • Update ZipFileBodyDecoder to enforce a maximum size of the decompressed archive and bailout as soon as it's reached (probably with a small default value and allow the users to configure it through the input options ?)

Release Notes

getkin/kin-openapi (github.com/getkin/kin-openapi)

v0.131.0

Compare Source

What's Changed

Full Changelog: getkin/kin-openapi@v0.130.0...v0.131.0

v0.130.0

Compare Source

What's Changed

New Contributors

Full Changelog: getkin/kin-openapi@v0.129.0...v0.130.0

v0.129.0

Compare Source

What's Changed

New Contributors

Full Changelog: getkin/kin-openapi@v0.128.0...v0.129.0

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
Copy link
Contributor Author

renovate bot commented May 15, 2025

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • The go directive was updated for compatibility reasons

Details:

Package Change
go 1.22 -> 1.22.5

@renovate renovate bot added the dependencies Pull requests that update a dependency file label May 15, 2025
@renovate renovate bot requested a review from a team as a code owner May 15, 2025 17:29
@renovate renovate bot added the dependencies Pull requests that update a dependency file label May 15, 2025
@socket-security
Copy link

socket-security bot commented May 15, 2025 •
edited
Loading

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License

View full report

@renovate renovate bot force-pushed the renovate/go-github.com-getkin-kin-openapi-vulnerability branch from 6ea9bf6 to 747d453 Compare June 14, 2025 13:21
@kusari-inspector
Copy link

kusari-inspector bot commented Jun 14, 2025 •
edited
Loading

Kusari Analysis Results

Analysis for commit: 657f8d9, performed at: 2025-07-15T14:06:58Z

• @kusari-inspector rerun - Trigger a re-analysis of this PR

• @kusari-inspector feedback [your message] - Send feedback to our AI and team

Recommendation

✅ PROCEED with this Pull Request

Summary

✅ No Flagged Issues Detected

All values appear to be within acceptable risk parameters.

This PR safely updates github.com/getkin/kin-openapi from v0.128.0 to v0.131.0, which fixes a HIGH severity vulnerability (CVE-2025-30153) related to ZIP bomb attacks that could cause out-of-memory conditions. The security code analysis shows no issues, and the dependency changes include only permissive licenses (MIT, BSD-3-Clause, Apache-2.0). The package has good maintenance (8/10) and code review (9/10) scores, indicating it's well-maintained. The additional YAML-related dependency changes appear to be related to this security update and don't introduce new risks.

Found this helpful? Give it a 👍 or 👎 reaction!

Click to expand for details and specific link to issues

Dependency Changes

Status Package Change Version Latest Version Advisories License
❓ Uncertain stdlib updated 1.22 → 1.22.5 Unknown None Unknown
⚠️ Flagged github.com/invopop/yaml removed 0.3.1 Unknown None Unknown
⚠️ Flagged github.com/invopop/yaml removed 0.3.1 Unknown None Unknown
❓ Uncertain stdlib updated 1.22 → 1.22.5 Unknown None Unknown
⚠️ Flagged github.com/invopop/yaml removed 0.3.1 Unknown None Unknown
⚠️ Flagged github.com/invopop/yaml removed 0.3.1 Unknown None Unknown
❓ Uncertain stdlib updated 1.22 → 1.22.5 Unknown None Unknown
⚠️ Flagged github.com/invopop/yaml removed 0.3.1 Unknown None Unknown
❓ Uncertain stdlib updated 1.22 → 1.22.5 Unknown None Unknown
⚠️ Flagged github.com/invopop/yaml removed 0.3.1 Unknown None Unknown
❓ Uncertain stdlib updated 1.22 → 1.22.5 Unknown None Unknown
⚠️ Flagged github.com/invopop/yaml removed 0.3.1 Unknown None Unknown
❓ Uncertain stdlib updated 1.22 → 1.22.5 Unknown None Unknown
⚠️ Flagged github.com/invopop/yaml removed 0.3.1 Unknown None Unknown
❓ Uncertain stdlib updated 1.22 → 1.22.5 Unknown None Unknown
⚠️ Flagged github.com/invopop/yaml removed 0.3.1 Unknown None Unknown

Risk Details

Safe Dependency Changes

Status Package Change Version Latest Version Advisories License
✅ Safe github.com/oasdiff/yaml added 0.0.0-20250309154309-f31be36b4037 v0.0.0-20250309154309-f31be36b4037 None BSD-3-Clause (permissive), MIT (permissive)
✅ Safe github.com/getkin/kin-openapi updated 0.128.0 → 0.131.0 v0.132.0 None MIT (permissive)
✅ Safe github.com/oasdiff/yaml3 added 0.0.0-20250309153720-d2182401db90 v0.0.0-20250309153720-d2182401db90 None Apache-2.0 (permissive), MIT (permissive)
✅ Safe github.com/getkin/kin-openapi updated 0.128.0 → 0.131.0 v0.132.0 None MIT (permissive)
✅ Safe github.com/oasdiff/yaml added 0.0.0-20250309154309-f31be36b4037 v0.0.0-20250309154309-f31be36b4037 None BSD-3-Clause (permissive), MIT (permissive)
✅ Safe github.com/oasdiff/yaml3 added 0.0.0-20250309153720-d2182401db90 v0.0.0-20250309153720-d2182401db90 None Apache-2.0 (permissive), MIT (permissive)
✅ Safe github.com/getkin/kin-openapi updated 0.128.0 → 0.131.0 v0.132.0 None MIT (permissive)
✅ Safe github.com/oasdiff/yaml added 0.0.0-20250309154309-f31be36b4037 v0.0.0-20250309154309-f31be36b4037 None BSD-3-Clause (permissive), MIT (permissive)
✅ Safe github.com/oasdiff/yaml3 added 0.0.0-20250309153720-d2182401db90 v0.0.0-20250309153720-d2182401db90 None Apache-2.0 (permissive), MIT (permissive)
✅ Safe github.com/oasdiff/yaml added 0.0.0-20250309154309-f31be36b4037 v0.0.0-20250309154309-f31be36b4037 None BSD-3-Clause (permissive), MIT (permissive)
✅ Safe github.com/oasdiff/yaml3 added 0.0.0-20250309153720-d2182401db90 v0.0.0-20250309153720-d2182401db90 None Apache-2.0 (permissive), MIT (permissive)
✅ Safe github.com/getkin/kin-openapi updated 0.128.0 → 0.131.0 v0.132.0 None MIT (permissive)
✅ Safe github.com/getkin/kin-openapi updated 0.128.0 → 0.131.0 v0.132.0 None MIT (permissive)
✅ Safe github.com/oasdiff/yaml added 0.0.0-20250309154309-f31be36b4037 v0.0.0-20250309154309-f31be36b4037 None BSD-3-Clause (permissive), MIT (permissive)
✅ Safe github.com/oasdiff/yaml3 added 0.0.0-20250309153720-d2182401db90 v0.0.0-20250309153720-d2182401db90 None Apache-2.0 (permissive), MIT (permissive)
✅ Safe github.com/getkin/kin-openapi updated 0.128.0 → 0.131.0 v0.132.0 None MIT (permissive)
✅ Safe github.com/oasdiff/yaml3 added 0.0.0-20250309153720-d2182401db90 v0.0.0-20250309153720-d2182401db90 None Apache-2.0 (permissive), MIT (permissive)
✅ Safe github.com/oasdiff/yaml added 0.0.0-20250309154309-f31be36b4037 v0.0.0-20250309154309-f31be36b4037 None BSD-3-Clause (permissive), MIT (permissive)
✅ Safe github.com/getkin/kin-openapi updated 0.128.0 → 0.131.0 v0.132.0 None MIT (permissive)
✅ Safe github.com/oasdiff/yaml added 0.0.0-20250309154309-f31be36b4037 v0.0.0-20250309154309-f31be36b4037 None BSD-3-Clause (permissive), MIT (permissive)
✅ Safe github.com/oasdiff/yaml3 added 0.0.0-20250309153720-d2182401db90 v0.0.0-20250309153720-d2182401db90 None Apache-2.0 (permissive), MIT (permissive)
✅ Safe github.com/getkin/kin-openapi updated 0.128.0 → 0.131.0 v0.132.0 None MIT (permissive)
✅ Safe github.com/oasdiff/yaml3 added 0.0.0-20250309153720-d2182401db90 v0.0.0-20250309153720-d2182401db90 None Apache-2.0 (permissive), MIT (permissive)
✅ Safe github.com/oasdiff/yaml added 0.0.0-20250309154309-f31be36b4037 v0.0.0-20250309154309-f31be36b4037 None BSD-3-Clause (permissive), MIT (permissive)
✅ Safe github.com/getkin/kin-openapi updated 0.128.0 → 0.131.0 v0.132.0 None MIT (permissive)
✅ Safe github.com/oasdiff/yaml3 added 0.0.0-20250309153720-d2182401db90 v0.0.0-20250309153720-d2182401db90 None Apache-2.0 (permissive), MIT (permissive)
✅ Safe github.com/oasdiff/yaml added 0.0.0-20250309154309-f31be36b4037 v0.0.0-20250309154309-f31be36b4037 None BSD-3-Clause (permissive), MIT (permissive)

@jamietanna jamietanna force-pushed the renovate/go-github.com-getkin-kin-openapi-vulnerability branch from 747d453 to d803a41 Compare July 15, 2025 13:58
@jamietanna jamietanna added the notable changes Used for release notes to highlight these more highly label Jul 15, 2025
@kusari-inspector
Copy link

kusari-inspector bot commented Jul 15, 2025

Kusari PR Analysis rerun based on - d803a41 performed at: 2025-07-15T13:58:28Z - link to updated analysis

@jamietanna jamietanna force-pushed the renovate/go-github.com-getkin-kin-openapi-vulnerability branch from d803a41 to 657f8d9 Compare July 15, 2025 14:06
@kusari-inspector
Copy link

kusari-inspector bot commented Jul 15, 2025

Kusari PR Analysis rerun based on - 657f8d9 performed at: 2025-07-15T14:06:58Z - link to updated analysis

@jamietanna jamietanna merged commit 364997d into main Jul 15, 2025
35 checks passed
@jamietanna jamietanna deleted the renovate/go-github.com-getkin-kin-openapi-vulnerability branch July 15, 2025 14:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jamietanna jamietanna jamietanna approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file notable changes Used for release notes to highlight these more highly

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@jamietanna