CVE-2026-100350
Deferred Deferred - Pending Action

Resource Exhaustion in kin-openapi OpenAPI Filter

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description
kin-openapi is a Go project for handling OpenAPI files. From 0.145.0 until 0.146.0, openapi3filter repeatedly calls regexp.MustCompile for the same parameter-name regular expression inside the per-query-key loop in urlValuesDecoder.DecodeObject used to decode a deepObject query parameter. An unauthenticated remote client can send an affected endpoint a request containing many unrelated query keys, causing ValidateRequest to perform work and allocations proportional to the attacker-controlled key count for every deepObject parameter. The expression itself is fixed and this is not regular expression denial of service; the resource consumption comes from loop-invariant recompilation. This issue is fixed in version 0.146.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-100350
EUVD
EUVD-2026-102158

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
getkin kin-openapi >= 0.145.0, < 0.146.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1050 The product has a loop body or loop condition that contains a control element that directly or indirectly consumes platform resources, e.g. messaging, sessions, locks, or file descriptors.
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-100350 is a denial-of-service vulnerability in the kin-openapi Go library affecting versions 0.145.0 to 0.146.0. It occurs in the openapi3filter package during deepObject query parameter decoding. The issue involves repeatedly compiling the same regular expression inside a loop for each query key, causing unnecessary CPU and memory usage. An attacker can exploit this by sending a request with many unrelated query keys, leading to excessive resource consumption before any handler processes the request.

Detection Guidance

Monitor for unusually high CPU usage during request processing, especially when handling deepObject query parameters. Check for requests with excessive query keys or large URLs. Use profiling tools like Go's pprof to identify hotspots in openapi3filter. Validate if your kin-openapi version is between 0.145.0 and 0.146.0.

Impact Analysis

This vulnerability can impact you by causing service disruptions due to CPU and memory exhaustion. An attacker could send specially crafted requests with many query keys, saturating server resources and making the system unresponsive. Even a few concurrent requests could fully consume CPU cores, leading to degraded performance or complete denial of service for legitimate users.

Mitigation Strategies

Upgrade kin-openapi to version 0.146.0 or later. Implement rate limiting or request size limits on endpoints using deepObject parameters. Use a web application firewall to block requests with excessive query keys. Temporarily disable deepObject parameter handling if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100350. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart