CVE-2026-100353
Deferred Deferred - Pending Action

kin-openapi OpenAPI 3.1 Array Schema Nil-Pointer Panic

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description
kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.149.0, three openapi3filter decoder paths that were missed by the fix for GHSA-p6wj-qrr4-pgh5 lack a nil-items guard for legal OpenAPI 3.1 array schemas. An unauthenticated remote client can trigger a deterministic nil-pointer panic through an array query parameter, a deepObject query parameter containing an array property, or an application/x-www-form-urlencoded request body whose array property appears inside an allOf, anyOf, or oneOf subschema. The query and composed-body paths reach urlValuesDecoder.parseArray, while the deepObject path reaches buildResObj, and all pass a nil items schema into code that dereferences it. This issue is fixed in version 0.149.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-19
AI Q&A
2026-10-15
EPSS Evaluated
2026-10-18
NVD
CVE-2026-100353
EUVD
EUVD-2026-102163

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
getkin kin-openapi >= 0.136.0, < 0.149.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the kin-openapi Go library used for handling OpenAPI files. It involves three decoder paths that lack proper nil checks for array schemas in OpenAPI 3.1 specifications. An attacker can trigger a nil-pointer panic by sending malformed requests with array query parameters, deepObject parameters containing arrays, or form-encoded bodies with arrays inside allOf/anyOf/oneOf subschemas. The issue was missed in a previous fix and allows unauthenticated remote crashes.

Detection Guidance

To detect this vulnerability, check if your kin-openapi library version is between 0.136.0 and 0.149.0. Use commands like 'go list -m github.com/getkin/kin-openapi' to verify the installed version. Monitor for crashes or panics in applications using OpenAPI 3.1 validation, especially with array query parameters or nested array properties in allOf/anyOf/oneOf schemas.

Impact Analysis

This vulnerability can cause denial of service (DoS) by crashing applications processing OpenAPI requests. In standard servers, it may cause per-request crashes. In non-standard hosts or goroutines, it can crash the entire process. Attackers can exploit it remotely without authentication or privileges.

Compliance Impact

This vulnerability causes denial of service through crashes, which could disrupt services handling sensitive data. For GDPR, availability is a principle, so prolonged outages may risk compliance. HIPAA requires availability of ePHI, so crashes could violate this requirement if systems become inaccessible.

Mitigation Strategies

Upgrade kin-openapi to version 0.149.0 or later immediately. If upgrading is not possible, implement input validation to reject array schemas without defined items in query parameters or request bodies. Add nil checks in custom decoders similar to the official fix.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100353. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart