CVE-2026-100347 · GHSA-fh4f-47mf-f2gj
kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static path
- Risk score
- 50/100
- CVSS
- 5.3 v3.1
- Exploit chance (30 days)
- 0.5%
- Published
- 15 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3filter.ValidationHandler uses the routers/legacy router, which passes an unsupported or non-canonical HTTP method for an existing static path to openapi3.PathItem.GetOperation. The default branch of GetOperation panics before authenticat…
- Affected
- github.com/getkin/kin-openapi (go) <= 0.144.0
- Fix
- Upgrade github.com/getkin/kin-openapi to 0.145.0 or later.
- Exploitation
- Public proof of concept
Story map
At a glance
github.com/getkin/kin-openapi: Amber, patch this week. kin-openapi is a Go project for handling OpenAPI files. Prior to 0.149.0, runtime request, response, and direct schema validation lacks cycle detection when an allOf, anyOf, or oneOf chain refers back to an ancestor schema, even though loading and document validation accept the circular reference. A request or respons…
The flaws
- CVE-2026-100347: Kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static path (CVSS 5.3 · EPSS 1%)
- CVE-2026-100354: Kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crash (CVSS 7.5 · EPSS 0%)
- CVE-2026-100352: Kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path (CVSS 7.5 · EPSS 0%)
- CVE-2026-100349: Kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content (CVSS 8.2 · EPSS 0%)
The fix
Upgrade github.com/getkin/kin-openapi: 0.145.0 · 0.149.0 · 0.148.0 · 0.146.0 or later on your release line
Who is exposed: github.com/getkin/kin-openapi (go) < 0.149.0
Where it stands
- Public proof of concept
Connects to
- Same weakness: CWE-248 (CWE-248). 63 other warnings in 30 days
Why it is Yellow
- CVSS 5.3 medium
- Public exploit or proof of concept referenced
- On your watchlist: Go
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| github.com/getkin/kin-openapi | go | <= 0.144.0 | 0.145.0 |
References
- https://github.com/advisories/GHSA-fh4f-47mf-f2gj
- https://github.com/getkin/kin-openapi/security/advisories/GHSA-fh4f-47mf-f2gj
- https://nvd.nist.gov/vuln/detail/CVE-2026-100347
- https://github.com/getkin/kin-openapi/commit/f1a5b523b82868d2d9be2e116b4e942892be72c3
- https://github.com/getkin/kin-openapi/releases/tag/v0.145.0
- https://github.com/advisories/GHSA-fh4f-47mf-f2gj
Original description
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3filter.ValidationHandler uses the routers/legacy router, which passes an unsupported or non-canonical HTTP method for an existing static path to openapi3.PathItem.GetOperation. The default branch of GetOperation panics before authentication runs, so an unauthenticated remote client can repeatedly send methods such as PROPFIND or lowercase get to abort connections and generate stack-trace log growth. The specific panic requires an exact static path; a concrete path matched only by a templated route does not reach the same sink. This issue is fixed in version 0.145.0.
Last activity 15 Oct 2026. Patch Forecast updates every hour.