CVE-2026-100353
7.5HighPublished 15 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on availability
- Weakness
- CWE-476
Impact
Unauthenticated remote attackers can crash the application via a denial-of-service panic. All they need is network access to send specially crafted array query parameters or form-urlencoded request bodies.
Root cause
The openapi3filter decoder omits nil-items checks for legal OpenAPI 3.1 array schemas in several parsing paths, triggering a nil-pointer dereference.
Affected systems
kin-openapi 0.136.0 through versions prior to 0.149.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Fix & remediation
Upgrade kin-openapi to version 0.149.0 or later. No interim configuration mitigation is provided, so prioritize updating the dependency.
$ go get github.com/getkin/kin-openapi@v0.149.0 && go mod tidyAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.149.0, three openapi3filter decoder paths that were missed by the fix for GHSA-p6wj-qrr4-pgh5 lack a nil-items guard for legal OpenAPI 3.1 array schemas. An unauthenticated remote client can trigger a deterministic nil-pointer panic through an array query parameter, a deepObject query parameter containing an array property, or an application/x-www-form-urlencoded request body whose array property appears inside an allOf, anyOf, or oneOf subschema. The query and composed-body paths reach urlValuesDecoder.parseArray, while the deepObject path reaches buildResObj, and all pass a nil items schema into code that dereferences it. This issue is fixed in version 0.149.0.