CVE-2026-100350 · GHSA-h4r5-mxv5-8mjc
kin-openapi deepObject query decoding repeatedly compiles an invariant regular expression
- Risk score
- 44/100
- CVSS
- 5.3 v3.1
- Exploit chance (30 days)
- 0.5%
- Published
- 15 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- kin-openapi is a Go project for handling OpenAPI files. From 0.145.0 until 0.146.0, openapi3filter repeatedly calls regexp.MustCompile for the same parameter-name regular expression inside the per-query-key loop in urlValuesDecoder.DecodeObject used to decode a deepObject query parameter. An unauthenticated remote cli…
- Affected
- github.com/getkin/kin-openapi (go) >= 0.145.0, < 0.146.0
- Fix
- Upgrade github.com/getkin/kin-openapi to 0.146.0 or later.
- Exploitation
- No known exploitation
Story map
At a glance
github.com/getkin/kin-openapi: Amber, patch this week. kin-openapi is a Go project for handling OpenAPI files. Prior to 0.149.0, runtime request, response, and direct schema validation lacks cycle detection when an allOf, anyOf, or oneOf chain refers back to an ancestor schema, even though loading and document validation accept the circular reference. A request or respons…
The flaws
- CVE-2026-100350: Kin-openapi deepObject query decoding repeatedly compiles an invariant regular expression (CVSS 5.3 · EPSS 0%)
- CVE-2026-100354: Kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crash (CVSS 7.5 · EPSS 0%)
- CVE-2026-100352: Kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path (CVSS 7.5 · EPSS 0%)
- CVE-2026-100349: Kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content (CVSS 8.2 · EPSS 0%)
The fix
Upgrade github.com/getkin/kin-openapi: 0.146.0 · 0.149.0 · 0.148.0 or later on your release line
Who is exposed: github.com/getkin/kin-openapi (go) < 0.149.0
Where it stands
- Public proof of concept
Connects to
- Same weakness: Denial of service (CWE-400). 253 other warnings in 30 days
Why it is Yellow
- CVSS 5.3 medium
- On your watchlist: Go
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| github.com/getkin/kin-openapi | go | >= 0.145.0, < 0.146.0 | 0.146.0 |
References
- https://github.com/advisories/GHSA-h4r5-mxv5-8mjc
- https://github.com/getkin/kin-openapi/security/advisories/GHSA-h4r5-mxv5-8mjc
- https://nvd.nist.gov/vuln/detail/CVE-2026-100350
- https://github.com/getkin/kin-openapi/commit/d090e36b2f1c42c898ba2a687a8f6e25f5ca727f
- https://github.com/getkin/kin-openapi/releases/tag/v0.146.0
- https://github.com/advisories/GHSA-h4r5-mxv5-8mjc
Original description
kin-openapi is a Go project for handling OpenAPI files. From 0.145.0 until 0.146.0, openapi3filter repeatedly calls regexp.MustCompile for the same parameter-name regular expression inside the per-query-key loop in urlValuesDecoder.DecodeObject used to decode a deepObject query parameter. An unauthenticated remote client can send an affected endpoint a request containing many unrelated query keys, causing ValidateRequest to perform work and allocations proportional to the attacker-controlled key count for every deepObject parameter. The expression itself is fixed and this is not regular expression denial of service; the resource consumption comes from loop-invariant recompilation. This issue is fixed in version 0.146.0.
Last activity 15 Oct 2026. Patch Forecast updates every hour.