CVE-2026-97394
Deferred Deferred - Pending Action

Nil-Pointer Panic in kin-openapi OpenAPI 3.1 Array Handling

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description
kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.143.0, openapi3filter accepts OpenAPI 3.1 array schemas without an items keyword and then dereferences the nil Schema.Items value while decoding application/x-www-form-urlencoded or multipart/form-data request bodies, response headers, and other array parameter surfaces. A remote unauthenticated client can reach an affected operation with a nonempty request or matching response and deterministically trigger a nil-pointer panic during ValidateRequest or ValidateResponse. OpenAPI 3.0 documents are not affected because document validation rejects arrays without items, and JSON request bodies use a different decoder path. This issue is fixed in version 0.143.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-97394
EUVD
EUVD-2026-102143

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
getkin kin-openapi >= 0.136.0, < 0.143.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-248 An exception is thrown from a function, but it is not caught.
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the kin-openapi Go library between versions 0.136.0 and 0.143.0. It involves a nil-pointer dereference panic in the openapi3filter component when processing OpenAPI 3.1 array schemas that lack an explicit 'items' definition. The decoders attempt to access a nil Items pointer without proper checks, causing the application to crash deterministically during request or response validation.

Detection Guidance

To detect this vulnerability, check if your kin-openapi library version is between 0.136.0 and 0.143.0. Run: go list -m github.com/getkin/kin-openapi. If the version falls in this range, the system is vulnerable.

Impact Analysis

Unauthenticated remote attackers can exploit this to crash your application by sending a single HTTP request to an affected OpenAPI 3.1 operation. The crash terminates the process without recovery, leading to denial of service. It affects validation paths for URL-encoded bodies, multipart forms, response headers, and path/cookie parameters.

Mitigation Strategies

Upgrade kin-openapi to version 0.143.0 or later. Use: go get -u github.com/getkin/kin-openapi@latest. This version includes nil checks to prevent panics when processing OpenAPI 3.1 array schemas without items.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97394. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart