CVE-2026-100352
Deferred Deferred - Pending Action

OpenAPI 3.1 Validation Flaw in kin-openapi

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.148.0, the OpenAPI 3.1 validation path passes YAML NaN and infinity numeric values to santhosh-tekuri/jsonschema v6.0.2 without applying kin-openapi's existing finite-number guards. A remote unauthenticated client can send an application/yaml or application/x-yaml request body containing .nan, .inf, or -.inf to an operation with a numeric constraint, causing the dependency to create and dereference a nil big.Rat during ValidateRequest. Standard net/http servers recover the panic per connection, while other hosts or application goroutines may terminate the process. This issue is fixed in version 0.148.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-19
AI Q&A
2026-10-15
EPSS Evaluated
2026-10-18
NVD
CVE-2026-100352
EUVD
EUVD-2026-102161

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
getkin kin-openapi < 0.148.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-754 The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the kin-openapi Go library before version 0.148.0. It allows a remote attacker to send a specially crafted YAML request containing special floating-point values like .nan, .inf, or -.inf. These values bypass existing number checks and cause the library to dereference a nil pointer during OpenAPI 3.1 validation, leading to a denial-of-service condition via a runtime panic.

Detection Guidance

To detect this vulnerability, monitor for crashes in applications using kin-openapi versions before 0.148.0 when processing YAML requests with .nan, .inf, or -.inf values. Check logs for panics or nil pointer dereferences in validation paths. Use commands like 'grep -r "kin-openapi" /path/to/dependencies' to identify vulnerable versions.

Impact Analysis

If you use kin-openapi versions before 0.148.0, an attacker could send malicious YAML requests to your application, causing it to crash. Standard HTTP servers may recover per-connection, but other setups or goroutines could terminate entirely, disrupting service availability.

Compliance Impact

This vulnerability primarily impacts system availability by causing denial-of-service conditions through process crashes. It does not directly affect data confidentiality or integrity. Compliance with standards like GDPR or HIPAA depends on maintaining service availability and protecting data. While this issue could disrupt services, it does not inherently violate these regulations unless it leads to unauthorized data access or prolonged downtime.

Mitigation Strategies

Immediately upgrade kin-openapi to version 0.148.0 or higher. Update the jsonschema/v6 dependency to v6.0.3 or later. If upgrading is not possible, disable OpenAPI 3.1 validation or block YAML requests containing .nan, .inf, or -.inf values at the network perimeter.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100352. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart