Threats tagged 'ghsa-g8cf-rcjf-c8cf'

CVE-2026-100354 is a high-severity vulnerability in kin-openapi versions prior to 0.149.0 involving uncontrolled recursion in runtime schema validation. While the spec loader and spec-time validator safely handle circular schema references, the runtime validators lack cycle detection, causing unbounded recursion when validating request or response data against schemas with circular allOf/anyOf/oneOf references. This leads to a fatal stack overflow in Go, crashing the entire server process and terminating all goroutines, including those serving unrelated clients. The vulnerability affects both response validation and request parameter decoding paths. No recoverable panic occurs, making the failure unrecoverable and causing a complete process termination.