OpenAPI Schema Dereference Vulnerability in kin-openapi

Executive Summary

CVE-2026-100348 is a nil-pointer dereference vulnerability in the kin-openapi Go library's OpenAPI 3 spec loader. It occurs when processing a self-referential $ref in the additionalProperties field of a schema. The loader crashes (panics) during spec loading before validation, causing a denial-of-service. The issue stems from accessing c.Value.AdditionalProperties without checking if c.Value is nil when a schema references its own additionalProperties.

An attacker can exploit this by providing a crafted OpenAPI document with a schema containing a self-referential additionalProperties reference. The crash happens in LoadFromData, LoadFromFile, or LoadFromURI paths during the resolveComponent function in openapi3/loader.go.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect Go applications using kin-openapi versions prior to 0.145.0. Check for crashes during OpenAPI spec loading, especially when processing self-referential additionalProperties references. Review logs for panics in openapi3.Loader functions like LoadFromData, LoadFromFile, or LoadFromURI.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause your application to crash (panic) when loading untrusted OpenAPI specifications. If you use kin-openapi to process OpenAPI files from untrusted sources, an attacker could provide a malicious spec that triggers the nil-pointer dereference, resulting in a denial-of-service. This affects services like spec registries, API-management platforms, linters, or converters that rely on kin-openapi's loader.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade kin-openapi to version 0.145.0 or later. If upgrading is not immediately possible, validate all OpenAPI documents before loading them to ensure they do not contain self-referential additionalProperties references. Implement input sanitization for OpenAPI specs.

Useful 0 Not Useful 0