CVE-2026-100353 · GHSA-vrcc-3ch7-hppw

kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter

Risk score: 65/100
CVSS: 7.5 v3.1
Exploit chance (30 days): 0.3%
Published: 15 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.149.0, three openapi3filter decoder paths that were missed by the fix for GHSA-p6wj-qrr4-pgh5 lack a nil-items guard for legal OpenAPI 3.1 array schemas. An unauthenticated remote client can trigger a deterministic nil-pointer panic through a…
Affected: github.com/getkin/kin-openapi (go) >= 0.136.0, < 0.149.0
Fix: Upgrade github.com/getkin/kin-openapi to 0.149.0 or later.
Exploitation: Public proof of concept

Why it is Amber

CVSS 7.5 high
Public exploit or proof of concept referenced
Remotely exploitable without logging in
On your watchlist: Go

Affected packages

Package	Ecosystem	Vulnerable	Fixed in
github.com/getkin/kin-openapi	go	>= 0.136.0, < 0.149.0	0.149.0

References

Original description

kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.149.0, three openapi3filter decoder paths that were missed by the fix for GHSA-p6wj-qrr4-pgh5 lack a nil-items guard for legal OpenAPI 3.1 array schemas. An unauthenticated remote client can trigger a deterministic nil-pointer panic through an array query parameter, a deepObject query parameter containing an array property, or an application/x-www-form-urlencoded request body whose array property appears inside an allOf, anyOf, or oneOf subschema. The query and composed-body paths reach urlValuesDecoder.parseArray, while the deepObject path reaches buildResObj, and all pass a nil items schema into code that dereferences it. This issue is fixed in version 0.149.0.

Last activity 15 Oct 2026. Patch Forecast updates every hour.