Source: golang-github-getkin-kin-openapi Version: 0.135.0-1 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerability was published for golang-github-getkin-kin-openapi. CVE-2026-73501[0]: | kin-openapi is a Go project for handling OpenAPI files. Prior to | 0.144.0, ValidationHandler.Load() in | openapi3filter/validation_handler.go silently replaces a nil | AuthenticationFunc with NoopAuthenticationFunc, which returns nil | without checking credentials. This substitution causes every OpenAPI | security requirement to be satisfied for unauthenticated requests | when an application relies on ValidationHandler as its enforcement | middleware. The no-op callback prevents the fail-closed | ErrAuthenticationServiceMissing path from being reached and forwards | the request to protected handlers that may require an API key, OAuth | token, or another security scheme. This issue is fixed in version | 0.144.0. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-73501 https://www.cve.org/CVERecord?id=CVE-2026-73501 [1] https://github.com/getkin/kin-openapi/security/advisories/GHSA-r277-6w6q-xmqw [2] https://github.com/getkin/kin-openapi/commit/f0407d53b0730280266f454b755010e7eeb985da Please adjust the affected versions in the BTS as needed. Regards, Salvatore
