CVE-2026-77354: kin-openapi has uncontrolled resource consumption in openapi3filter deepObject query parameter decoding

An uncontrolled resource consumption vulnerability in openapi3filter lets any unauthenticated client force multi-gigabyte heap allocation with a single, tiny HTTP request. When a spec declares a deepObject-style query parameter whose schema contains an array (a normal, documented pattern), the decoder reconstructs the array by reading the largest attacker-supplied index and allocating one slot for every position from 0 up to that index — before schema validation (including maxItems) ever runs. A request as small as 24 bytes (?param[items][50000000]=x) drives heap allocation to ~6.1 GiB, reliably triggering an OOM kill / restart loop on memory-constrained services.