Description
kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.149.0, three openapi3filter decoder paths that were missed by the fix for GHSA-p6wj-qrr4-pgh5 lack a nil-items guard for legal OpenAPI 3.1 array schemas. An unauthenticated remote client can trigger a deterministic nil-pointer panic through an array query parameter, a deepObject query parameter containing an array property, or an application/x-www-form-urlencoded request body whose array property appears inside an allOf, anyOf, or oneOf subschema. The query and composed-body paths reach urlValuesDecoder.parseArray, while the deepObject path reaches buildResObj, and all pass a nil items schema into code that dereferences it. This issue is fixed in version 0.149.0.
Published: 2026-10-15
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Apply Patch
AI Analysis

Impact

A flaw in the kin-openapi Go library allows an unauthenticated remote client to send specially crafted OpenAPI requests that trigger a deterministic nil‑pointer panic during array schema decoding. The vulnerability, classified under CWE‑476, can crash any application that uses the library. This results in a denial of service for services that depend on kin-openapi to parse OpenAPI specifications.

Affected Systems

The vulnerability affects the kin-openapi library released by the getkin organization, specifically all versions from 0.136.0 through 0.148.1. The issue is remedied in version 0.149.0. Any Go application that integrates kin-openapi to process OpenAPI 3.1 definition files and exposes HTTP endpoints is at risk.

Risk and Exploitability

The vulnerability has a CVSS score of 7.5, indicating a high severity. The EPSS score of less than 1% shows that exploitation likelihood is currently very low, and the issue is not listed in the CISA KEV catalog. Nonetheless, the bug is triggered by unauthenticated HTTP requests; a remote attacker can reliably cause a crash by sending an array query parameter, a deepObject query parameter with an array property, or a form‑encoded body containing an array in a composed schema. If the application does not isolate the library in a separate process, the panic could bring down the entire service, leading to a denial of service.

Generated by OpenCVE AI on October 16, 2026 at 20:14 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update kin-openapi to version 0.149.0 or later.
  • Restart the application to ensure any cached state is cleared after the update.
  • As a temporary measure, validate that all array parameters and body properties include defined items before they reach the decoder to avoid nil‑pointer dereference.

Generated by OpenCVE AI on October 16, 2026 at 20:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-vrcc-3ch7-hppw kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter
History

Thu, 29 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 23 Oct 2026 13:15:00 +0000

Type Values Removed Values Added
First Time appeared Getkin
Getkin kin-openapi
Vendors & Products Getkin
Getkin kin-openapi

Sat, 17 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important

Thu, 15 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Description kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.149.0, three openapi3filter decoder paths that were missed by the fix for GHSA-p6wj-qrr4-pgh5 lack a nil-items guard for legal OpenAPI 3.1 array schemas. An unauthenticated remote client can trigger a deterministic nil-pointer panic through an array query parameter, a deepObject query parameter containing an array property, or an application/x-www-form-urlencoded request body whose array property appears inside an allOf, anyOf, or oneOf subschema. The query and composed-body paths reach urlValuesDecoder.parseArray, while the deepObject path reaches buildResObj, and all pass a nil items schema into code that dereferences it. This issue is fixed in version 0.149.0.
Title kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter
Weaknesses CWE-476
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Getkin Kin-openapi
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-29T13:41:31.986Z

Reserved: 2026-09-25T19:19:54.697Z

Link: CVE-2026-100353

cve-icon Vulnrichment

Updated: 2026-10-29T13:41:09.353Z

cve-icon NVD

Status : Deferred

Published: 2026-10-15T17:17:07.627

Modified: 2026-10-29T14:17:40.677

Link: CVE-2026-100353

cve-icon Redhat

Severity : Important

Publid Date: 2026-10-15T16:03:50Z

Links: CVE-2026-100353 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T13:00:16Z

Weaknesses