kin-openapi contains a flaw in OpenAPI 3.1 validation where YAML NaN and infinity values bypass the library’s finite‑number checks and are passed to a downstream JSONSchema validator that dereferences a nil big.Rat. This causes the validator to panic during request validation. The panic is contained only by the standard net/http recovery per connection; on other hosts or application goroutines the panic can terminate the process. The weakness involves a null pointer dereference and improper handling of special numeric values, as captured by CWE‑476 and CWE‑754.

The affected product is the Go library getkin:kin-openapi. Any version prior to 0.148.0 is vulnerable; versions 0.148.0 and later include the fix.

The CVSS score is 7.5 and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. A remote unauthenticated client can trigger the flaw by sending an HTTP request with a YAML body containing .nan, .inf, or -.inf to an operation that has a numeric constraint. The exploitation requires network access to the target service and can be performed without authentication, leading to denial of service or application termination depending on the server implementation.