UBUNTU-CVE-2026-73501

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2026-73501
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-73501.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-73501
Upstream
Published
2026-08-13T00:00:00Z
Modified
2026-08-13T19:31:10.213355465Z
Severity
  • 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
  • Ubuntu - medium
Summary
[none]
Details

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load() in openapi3filter/validation_handler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without checking credentials. This substitution causes every OpenAPI security requirement to be satisfied for unauthenticated requests when an application relies on ValidationHandler as its enforcement middleware. The no-op callback prevents the fail-closed ErrAuthenticationServiceMissing path from being reached and forwards the request to protected handlers that may require an API key, OAuth token, or another security scheme. This issue is fixed in version 0.144.0.

References

Affected packages

Ubuntu:22.04:LTS / golang-github-getkin-kin-openapi

Package

Name
golang-github-getkin-kin-openapi
Purl
pkg:deb/ubuntu/golang-github-getkin-kin-openapi?arch=source&distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.32.0-2
0.80.0-1
0.85.0-1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "0.85.0-1",
            "binary_name": "golang-github-getkin-kin-openapi-dev"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-73501.json"

Ubuntu:24.04:LTS / golang-github-getkin-kin-openapi

Package

Name
golang-github-getkin-kin-openapi
Purl
pkg:deb/ubuntu/golang-github-getkin-kin-openapi?arch=source&distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.117.0-1
0.120.0-1
0.122.0-3
0.123.0-1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "0.123.0-1",
            "binary_name": "golang-github-getkin-kin-openapi-dev"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-73501.json"

Ubuntu:26.04:LTS / golang-github-getkin-kin-openapi

Package

Name
golang-github-getkin-kin-openapi
Purl
pkg:deb/ubuntu/golang-github-getkin-kin-openapi?arch=source&distro=resolute

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.124.0-1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "0.124.0-1",
            "binary_name": "golang-github-getkin-kin-openapi-dev"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-73501.json"