Description
kin-openapi is a Go project for handling OpenAPI files. From 0.145.0 until 0.146.0, openapi3filter repeatedly calls regexp.MustCompile for the same parameter-name regular expression inside the per-query-key loop in urlValuesDecoder.DecodeObject used to decode a deepObject query parameter. An unauthenticated remote client can send an affected endpoint a request containing many unrelated query keys, causing ValidateRequest to perform work and allocations proportional to the attacker-controlled key count for every deepObject parameter. The expression itself is fixed and this is not regular expression denial of service; the resource consumption comes from loop-invariant recompilation. This issue is fixed in version 0.146.0.
Published: 2026-10-15
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Patch Now
AI Analysis

Impact

The issue arises in the Go library kin-openapi, where the openapi3filter component repeatedly invokes regexp.MustCompile for the same deepObject query parameter expression inside a loop over query keys. An attacker without authentication can send a request with a large number of irrelevant query keys, causing the validator to perform work and allocate memory proportional to the number of keys for every deepObject parameter. This leads to significant resource consumption and can bring affected services offline. The weakness is tied to CWE-1050, CWE-400, and CWE-770.

Affected Systems

The vulnerability affects the Go project kin-openapi from getkin, specifically versions 0.145.0 through before 0.146.0. Any application that uses this library and exposes HTTP endpoints validated by openapi3filter with a deepObject query parameter is potentially impacted.

Risk and Exploitability

The CVSS score of 5.3 indicates a medium severity for availability. The EPSS score is currently unavailable, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely by sending HTTP requests containing many unrelated query parameters to a vulnerable endpoint; no authentication or privileged access is required. The exploit path is straightforward, and the resource exhaustion can disrupt service availability, especially under high load or on resource‑constrained environments.

Generated by OpenCVE AI on October 16, 2026 at 06:48 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to kin-openapi v0.146.0 or later to eliminate the repeated compilation of the invariant regular expression.
  • If an upgrade cannot be performed immediately, restrict exposure of endpoints that use the deepObject query parameter by limiting the total number of allowed query keys or imposing input size limits.
  • Implement defensive rate limiting or request throttling on affected endpoints to guard against excessive resource consumption.
  • Validate the library version used at runtime and monitor application logs for signs of high CPU or memory usage associated with deepObject query parsing.

Generated by OpenCVE AI on October 16, 2026 at 06:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-h4r5-mxv5-8mjc kin-openapi deepObject query decoding repeatedly compiles an invariant regular expression
History

Fri, 23 Oct 2026 13:15:00 +0000

Type Values Removed Values Added
First Time appeared Getkin
Getkin kin-openapi
Vendors & Products Getkin
Getkin kin-openapi

Fri, 16 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Thu, 15 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 15 Oct 2026 16:00:00 +0000

Type Values Removed Values Added
Description kin-openapi is a Go project for handling OpenAPI files. From 0.145.0 until 0.146.0, openapi3filter repeatedly calls regexp.MustCompile for the same parameter-name regular expression inside the per-query-key loop in urlValuesDecoder.DecodeObject used to decode a deepObject query parameter. An unauthenticated remote client can send an affected endpoint a request containing many unrelated query keys, causing ValidateRequest to perform work and allocations proportional to the attacker-controlled key count for every deepObject parameter. The expression itself is fixed and this is not regular expression denial of service; the resource consumption comes from loop-invariant recompilation. This issue is fixed in version 0.146.0.
Title kin-openapi deepObject query decoding repeatedly compiles an invariant regular expression
Weaknesses CWE-1050
CWE-400
CWE-770
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}

Subscriptions

Getkin Kin-openapi
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-15T18:32:57.402Z

Reserved: 2026-09-25T19:19:54.697Z

Link: CVE-2026-100350

cve-icon Vulnrichment

Updated: 2026-10-15T18:32:53.310Z

cve-icon NVD

Status : Deferred

Published: 2026-10-15T16:17:30.793

Modified: 2026-10-15T19:17:12.833

Link: CVE-2026-100350

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-15T15:37:19Z

Links: CVE-2026-100350 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T13:00:16Z

Weaknesses
  • CWE-1050

    Excessive Platform Resource Consumption within a Loop

  • CWE-400

    Uncontrolled Resource Consumption

  • CWE-770

    Allocation of Resources Without Limits or Throttling