CVE-2026-100352
Deferred Deferred - Pending Action

OpenAPI 3.1 Validation Flaw in kin-openapi

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.148.0, the OpenAPI 3.1 validation path passes YAML NaN and infinity numeric values to santhosh-tekuri/jsonschema v6.0.2 without applying kin-openapi's existing finite-number guards. A remote unauthenticated client can send an application/yaml or application/x-yaml request body containing .nan, .inf, or -.inf to an operation with a numeric constraint, causing the dependency to create and dereference a nil big.Rat during ValidateRequest. Standard net/http servers recover the panic per connection, while other hosts or application goroutines may terminate the process. This issue is fixed in version 0.148.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-100352
EUVD
EUVD-2026-102161

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
getkin kin-openapi < 0.148.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-754 The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the kin-openapi Go library before version 0.148.0. It allows a remote attacker to send a specially crafted YAML request containing special floating-point values like .nan, .inf, or -.inf. These values bypass existing number checks and cause the library to dereference a nil pointer during OpenAPI 3.1 validation, leading to a denial-of-service condition via a runtime panic.

Detection Guidance

To detect this vulnerability, monitor for crashes in applications using kin-openapi versions before 0.148.0 when processing YAML requests with .nan, .inf, or -.inf values. Check logs for panics or nil pointer dereferences in validation paths. Use commands like 'grep -r "kin-openapi" /path/to/dependencies' to identify vulnerable versions.

Impact Analysis

If you use kin-openapi versions before 0.148.0, an attacker could send malicious YAML requests to your application, causing it to crash. Standard HTTP servers may recover per-connection, but other setups or goroutines could terminate entirely, disrupting service availability.

Mitigation Strategies

Immediately upgrade kin-openapi to version 0.148.0 or higher. Update the jsonschema/v6 dependency to v6.0.3 or later. If upgrading is not possible, disable OpenAPI 3.1 validation or block YAML requests containing .nan, .inf, or -.inf values at the network perimeter.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100352. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart