kin-openapi versions prior to 0.149.0 lack cycle detection for nested allOf, anyOf, or oneOf schemas that reference an ancestor schema. When a request, response, or direct validation reaches such a circular reference, the library recurses without limit in Schema.visitJSON or openapi3filter.decodeValue, exhausting the Go goroutine stack. The resulting stack overflow is fatal, cannot be caught by recover, and terminates the entire process—including unrelated requests—resulting in a denial‑of‑service condition for all users of the application.

The vulnerability affects the GetKin project, specifically the kin-openapi Go library. All releases earlier than v0.149.0 are impacted; the security fix is included beginning with version 0.149.0.

The CVSS score of 7.5 reflects a moderate‑to‑high severity for causing an unhandled crash, though the EPSS score of less than 1% indicates a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation would typically occur when an attacker supplies or induces processing of a circular OpenAPI schema—either during file upload, API import, or request parsing—causing the library to enter infinite recursion and crash the host process. This leads to a denial of service for all traffic handled by the affected process.