CVE-2026-100347
Deferred Deferred - Pending Action

Path Traversal in kin-openapi OpenAPI Handler

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3filter.ValidationHandler uses the routers/legacy router, which passes an unsupported or non-canonical HTTP method for an existing static path to openapi3.PathItem.GetOperation. The default branch of GetOperation panics before authentication runs, so an unauthenticated remote client can repeatedly send methods such as PROPFIND or lowercase get to abort connections and generate stack-trace log growth. The specific panic requires an exact static path; a concrete path matched only by a templated route does not reach the same sink. This issue is fixed in version 0.145.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-100347
EUVD
EUVD-2026-102156

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
getkin kin-openapi < 0.145.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-248 An exception is thrown from a function, but it is not caught.
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a denial-of-service (DoS) flaw in the kin-openapi library affecting versions up to 0.144.0. It occurs when an unauthenticated attacker sends a request with an unsupported or non-canonical HTTP method (like PROPFIND or lowercase get) to a static path. The legacy router fails to handle these methods properly, causing a panic in the GetOperation function before authentication runs. This leads to connection aborts and unbounded error log growth, impacting system availability.

Detection Guidance

To detect this vulnerability, monitor for repeated connection aborts or stack-trace log growth when non-canonical HTTP methods like PROPFIND or lowercase get are sent to static paths. Check if your kin-openapi version is below 0.145.0.

Impact Analysis

An attacker can exploit this to crash server processes handling OpenAPI requests, causing repeated connection aborts and excessive error logging. This degrades system performance and may lead to service unavailability. The attack requires no authentication and can be triggered with a single malicious request to any static path.

Mitigation Strategies

Upgrade kin-openapi to version 0.145.0 or later to patch the vulnerability. Ensure proper error handling for unsupported HTTP methods in your router configuration.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100347. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart