Threats tagged 'ghsa-vrcc-3ch7-hppw'

CVE-2026-100353 is a high-severity vulnerability in kin-openapi versions >=0.136.0 and <0.149.0 that causes a nil pointer dereference (NULL pointer dereference) during request validation. The issue arises when an OpenAPI 3.1 array schema omits the 'items' keyword, which is allowed by JSON Schema 2020-12. This leads to unguarded dereferences in multiple code paths handling query parameters, deepObject query parameters, and URL-encoded request bodies, causing deterministic panics triggered by unauthenticated clients.