CVE-2026-100354
Deferred Deferred - Pending Action

Stack Overflow in kin-openapi Due to Unbounded Recursion

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.149.0, runtime request, response, and direct schema validation lacks cycle detection when an allOf, anyOf, or oneOf chain refers back to an ancestor schema, even though loading and document validation accept the circular reference. A request or response that reaches the affected schema causes unbounded recursion in Schema.visitJSON or openapi3filter.decodeValue and exhausts the Go goroutine stack. The resulting fatal stack overflow cannot be caught with recover and terminates the entire process, including unrelated requests. This issue is fixed in version 0.149.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-19
AI Q&A
2026-10-15
EPSS Evaluated
2026-10-18
NVD
CVE-2026-100354
EUVD
EUVD-2026-102162

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
getkin kin-openapi < 0.149.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-674 The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a stack overflow issue in the kin-openapi Go library affecting versions before 0.149.0. It occurs when schemas use circular references in allOf, anyOf, or oneOf chains. During runtime validation or request decoding, this causes infinite recursion leading to a fatal stack overflow that crashes the entire process, not just the affected goroutine.

Detection Guidance

Detecting this vulnerability requires checking if your kin-openapi library version is below 0.149.0. Use commands like 'go list -m github.com/getkin/kin-openapi' to check the installed version. If the version is older, the system is vulnerable.

Impact Analysis

An attacker could exploit this by providing a malicious OpenAPI spec or triggering a latent circular schema in a trusted spec. This would crash the entire service, causing a denial of service that affects all users and unrelated requests on the same host. The crash cannot be recovered from using Go's recover mechanism.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by causing service disruptions due to process termination. GDPR requires data processing systems to maintain availability, while HIPAA mandates reliable access to protected health information. A denial-of-service via stack overflow may violate these requirements.

Mitigation Strategies

Upgrade the kin-openapi library to version 0.149.0 or later immediately. This can be done using 'go get -u github.com/getkin/kin-openapi@latest'. Ensure all dependent services are restarted after the upgrade.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100354. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart