CVE-2026-100352 · GHSA-rj39-cv6w-8wv7

kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path

Risk score: 67/100
CVSS: 7.5 v3.1
Exploit chance (30 days): 0.4%
Published: 15 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: kin-openapi is a Go project for handling OpenAPI files. Prior to 0.148.0, the OpenAPI 3.1 validation path passes YAML NaN and infinity numeric values to santhosh-tekuri/jsonschema v6.0.2 without applying kin-openapi's existing finite-number guards. A remote unauthenticated client can send an application/yaml or applic…
Affected: github.com/getkin/kin-openapi (go) < 0.148.0
Fix: Upgrade github.com/getkin/kin-openapi to 0.148.0 or later.
Exploitation: Public proof of concept

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

github.com/getkin/kin-openapi: Amber, patch this week. kin-openapi is a Go project for handling OpenAPI files. Prior to 0.149.0, runtime request, response, and direct schema validation lacks cycle detection when an allOf, anyOf, or oneOf chain refers back to an ancestor schema, even though loading and document validation accept the circular reference. A request or respons…

The flaws

CVE-2026-100352: Kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path (CVSS 7.5 · EPSS 0%)
CVE-2026-100354: Kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crash (CVSS 7.5 · EPSS 0%)
CVE-2026-100349: Kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content (CVSS 8.2 · EPSS 0%)
CVE-2026-100353: Kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter (CVSS 7.5 · EPSS 0%)

The fix

Upgrade github.com/getkin/kin-openapi: 0.148.0 · 0.149.0 · 0.146.0 or later on your release line

Who is exposed: github.com/getkin/kin-openapi (go) < 0.149.0

Where it stands

Public proof of concept

Connects to

Same weakness: CWE-754 (CWE-754). 16 other warnings in 30 days

Why it is Amber

CVSS 7.5 high
Public exploit or proof of concept referenced
Remotely exploitable without logging in
On your watchlist: Go

Affected packages

Package	Ecosystem	Vulnerable	Fixed in
github.com/getkin/kin-openapi	go	< 0.148.0	0.148.0

References

Original description

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.148.0, the OpenAPI 3.1 validation path passes YAML NaN and infinity numeric values to santhosh-tekuri/jsonschema v6.0.2 without applying kin-openapi's existing finite-number guards. A remote unauthenticated client can send an application/yaml or application/x-yaml request body containing .nan, .inf, or -.inf to an operation with a numeric constraint, causing the dependency to create and dereference a nil big.Rat during ValidateRequest. Standard net/http servers recover the panic per connection, while other hosts or application goroutines may terminate the process. This issue is fixed in version 0.148.0.

Last activity 15 Oct 2026. Patch Forecast updates every hour.