CVE-2026-100354 · GHSA-g8cf-rcjf-c8cf
kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crash
- Risk score
- 67/100
- CVSS
- 7.5 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 15 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- kin-openapi is a Go project for handling OpenAPI files. Prior to 0.149.0, runtime request, response, and direct schema validation lacks cycle detection when an allOf, anyOf, or oneOf chain refers back to an ancestor schema, even though loading and document validation accept the circular reference. A request or respons…
- Affected
- github.com/getkin/kin-openapi (go) < 0.149.0
- Fix
- Upgrade github.com/getkin/kin-openapi to 0.149.0 or later.
- Exploitation
- Public proof of concept
Story map
At a glance
github.com/getkin/kin-openapi: Amber, patch this week. kin-openapi is a Go project for handling OpenAPI files. Prior to 0.149.0, runtime request, response, and direct schema validation lacks cycle detection when an allOf, anyOf, or oneOf chain refers back to an ancestor schema, even though loading and document validation accept the circular reference. A request or respons…
The flaws
- CVE-2026-100354: Kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crash (CVSS 7.5 · EPSS 0%)
- CVE-2026-100352: Kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path (CVSS 7.5 · EPSS 0%)
- CVE-2026-100349: Kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content (CVSS 8.2 · EPSS 0%)
- CVE-2026-100353: Kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter (CVSS 7.5 · EPSS 0%)
The fix
Upgrade github.com/getkin/kin-openapi: 0.149.0 · 0.148.0 · 0.146.0 or later on your release line
Who is exposed: github.com/getkin/kin-openapi (go) < 0.149.0
Where it stands
- Public proof of concept
Connects to
- Same weakness: CWE-674 (CWE-674). 56 other warnings in 30 days
Why it is Amber
- CVSS 7.5 high
- Public exploit or proof of concept referenced
- Remotely exploitable without logging in
- On your watchlist: Go
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| github.com/getkin/kin-openapi | go | < 0.149.0 | 0.149.0 |
References
- https://github.com/advisories/GHSA-g8cf-rcjf-c8cf
- https://github.com/getkin/kin-openapi/security/advisories/GHSA-g8cf-rcjf-c8cf
- https://nvd.nist.gov/vuln/detail/CVE-2026-100354
- https://github.com/getkin/kin-openapi/commit/9245cef66c840e27a08409a8a5cd0ee930c5bcff
- https://github.com/getkin/kin-openapi/releases/tag/v0.149.0
- https://github.com/advisories/GHSA-g8cf-rcjf-c8cf
Original description
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.149.0, runtime request, response, and direct schema validation lacks cycle detection when an allOf, anyOf, or oneOf chain refers back to an ancestor schema, even though loading and document validation accept the circular reference. A request or response that reaches the affected schema causes unbounded recursion in Schema.visitJSON or openapi3filter.decodeValue and exhausts the Go goroutine stack. The resulting fatal stack overflow cannot be caught with recover and terminates the entire process, including unrelated requests. This issue is fixed in version 0.149.0.
Last activity 15 Oct 2026. Patch Forecast updates every hour.