CVE-2026-97394
7.5HighPublished 15 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on availability
- Weakness
- CWE-248, CWE-476
Impact
Remote unauthenticated attackers can crash the Go service via denial of service. They only need to send a request hitting an endpoint configured with an OpenAPI 3.1 array schema missing the items keyword.
Root cause
openapi3filter fails to check for a nil Schema.Items pointer when decoding form data, multipart bodies, or headers against OpenAPI 3.1 array schemas, causing a nil-pointer dereference panic.
Affected systems
kin-openapi 0.136.0 through 0.142.x (fixed in 0.143.0)
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Fix & remediation
Upgrade github.com/getkin/kin-openapi to v0.143.0 or later. If patching immediately is not possible, ensure OpenAPI 3.1 schemas explicitly define the 'items' keyword on all array definitions, or revert schema files to OpenAPI 3.0.
$ go get github.com/getkin/kin-openapi@v0.143.0 && go mod tidyAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.143.0, openapi3filter accepts OpenAPI 3.1 array schemas without an items keyword and then dereferences the nil Schema.Items value while decoding application/x-www-form-urlencoded or multipart/form-data request bodies, response headers, and other array parameter surfaces. A remote unauthenticated client can reach an affected operation with a nonempty request or matching response and deterministically trigger a nil-pointer panic during ValidateRequest or ValidateResponse. OpenAPI 3.0 documents are not affected because document validation rejects arrays without items, and JSON request bodies use a different decoder path. This issue is fixed in version 0.143.0.