Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-100348 · GHSA-mh7x-f8wq-4jhx

kin-openapi spec loader panics on a self-referential additionalProperties $ref (nil-pointer DoS)

Risk score
43/100
CVSS
5.3 v3.1
Exploit chance (30 days)
0.4%
Published
15 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3.Loader can dereference a nil SchemaRef.Value while resolving a self-referential additionalProperties JSON Reference such as a schema that points to its own additionalProperties member. Loading an attacker-controlled OpenAPI document thr…
Affected
github.com/getkin/kin-openapi (go) <= 0.144.0
Fix
Upgrade github.com/getkin/kin-openapi to 0.145.0 or later.
Exploitation
No known exploitation

Story map

Story map: github.com/getkin/kin-openapiTHE FLAWSTHE FIXCVE-2026-100348Kin-openapi spec loader panicson a self-referentialadditionalProperties $ref…CVSS 5.3 · EPSS 0%CVE-2026-100354Kin-openapi: UncontrolledRecursion on CircularallOf/anyOf/oneOf Schemas…CVSS 7.5 · EPSS 0%CVE-2026-100352Kin-openapi: YAML NaN/InfValues Bypass Built-in Guardsand Panic via OAS 3.1…CVSS 7.5 · EPSS 0%CVE-2026-100349Kin-openapi openapi3filter:nil-pointer panic inValidateResponse on a…CVSS 8.2 · EPSS 0%Upgrade…0.145.0 · 0.149.0 · 0.148.0 ·0.146.0or later on your release lineWho is exposedgithub.com/getkin/kin-openapi(go) < 0.149.0AMBER · PATCH THIS WEEKgithub.com/getkin/kin-openapikin-openapi is a Go project forhandling OpenAPI files. Prior to0.149.0, runtime request,response, and direct schemavalidation lacks cycle detectionwhen an allOf, anyOf, or oneOfchain refers back to an…Where it standsPublic proof of conceptCONNECTS TOSame weaknessNull pointer dereference (CWE-476)90 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

github.com/getkin/kin-openapi: Amber, patch this week. kin-openapi is a Go project for handling OpenAPI files. Prior to 0.149.0, runtime request, response, and direct schema validation lacks cycle detection when an allOf, anyOf, or oneOf chain refers back to an ancestor schema, even though loading and document validation accept the circular reference. A request or respons…

The flaws

  • CVE-2026-100348: Kin-openapi spec loader panics on a self-referential additionalProperties $ref (nil-pointer DoS) (CVSS 5.3 · EPSS 0%)
  • CVE-2026-100354: Kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crash (CVSS 7.5 · EPSS 0%)
  • CVE-2026-100352: Kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path (CVSS 7.5 · EPSS 0%)
  • CVE-2026-100349: Kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content (CVSS 8.2 · EPSS 0%)

The fix

Upgrade github.com/getkin/kin-openapi: 0.145.0 · 0.149.0 · 0.148.0 · 0.146.0 or later on your release line

Who is exposed: github.com/getkin/kin-openapi (go) < 0.149.0

Where it stands

  • Public proof of concept

Connects to

Why it is Yellow

  • CVSS 5.3 medium
  • On your watchlist: Go

Affected packages

PackageEcosystemVulnerableFixed in
github.com/getkin/kin-openapigo<= 0.144.00.145.0

References

Original description

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3.Loader can dereference a nil SchemaRef.Value while resolving a self-referential additionalProperties JSON Reference such as a schema that points to its own additionalProperties member. Loading an attacker-controlled OpenAPI document through LoadFromData, LoadFromFile, or LoadFromURI reaches resolveComponent before document validation and can panic the loading process. Resolved additionalProperties schemas and ordinary recursive schemas do not take the vulnerable nil-value path. This issue is fixed in version 0.145.0.

Last activity 15 Oct 2026. Patch Forecast updates every hour.