kin-openapi is a Go library for processing OpenAPI specifications. Prior to version 0.145.0, its ValidationHandler uses a legacy router that accepts any HTTP method on static paths. When an unsupported or non‑canonical method, such as PROPFIND or a lowercase "get", is sent, the router forwards the request to openapi3.PathItem.GetOperation which then panics before authentication is performed. The panic terminates the connection and writes a full stack trace to the application logs, allowing an unauthenticated remote client to repeatedly trigger the fault, causing connection aborts and rapid log file growth. This results in a denial‑of‑service condition for the application consuming the library. The vulnerability only affects exact static routes; routes served by templated patterns do not traverse the same code path and thus are not exploitable in the same way. The flaw is addressed in library release 0.145.0 and later.

The affected product is kin-openapi from getkin. All releases prior to 0.145.0 are vulnerable. Applications that compile or import kin-openapi versions earlier than 0.145.0 and expose static HTTP endpoints are impacted, regardless of the deployment environment.

The CVSS score is 5.3, indicating a moderate severity. EPSS data is not available, but the vulnerability is exploitable by any unauthenticated client over the network using HTTP. It is not listed in CISA’s KEV catalog, meaning no proven, live exploitation has been publicly documented. An attacker can remotely trigger the panic simply by sending unsupported or non‑canonical HTTP methods to a known static URL; no prior authentication or elevated privileges are required. The effect is a denial of service through application termination and log bloat.