CVE-2026-100353 is a high-severity vulnerability in kin-openapi versions >=0.136.0 and <0.149.0 that causes a nil pointer dereference (NULL pointer dereference) during request validation. The issue arises when an OpenAPI 3.1 array schema omits the 'items' keyword, which is allowed by JSON Schema 2020-12. This leads to unguarded dereferences in multiple code paths handling query parameters, deepObject query parameters, and URL-encoded request bodies, causing deterministic panics triggered by unauthenticated clients.
CVE-2026-100354 is a high-severity vulnerability in kin-openapi versions prior to 0.149.0 involving uncontrolled recursion in runtime schema validation. While the spec loader and spec-time validator safely handle circular schema references, the runtime validators lack cycle detection, causing unbounded recursion when validating request or response data against schemas with circular allOf/anyOf/oneOf references. This leads to a fatal stack overflow in Go, crashing the entire server process and terminating all goroutines, including those serving unrelated clients. The vulnerability affects both response validation and request parameter decoding paths. No recoverable panic occurs, making the failure unrecoverable and causing a complete process termination.
kin-openapi versions prior to 0.148.0 improperly handle unusual numeric values such as YAML NaN and infinity during OpenAPI 3.1 validation. This flaw allows a remote unauthenticated client to send specially crafted YAML request bodies containing .nan, .inf, or -.inf values, triggering a panic in the dependency jsonschema v6.0.2. The panic occurs due to dereferencing a nil big.Rat during request validation, which can cause process termination in some hosting environments. The issue is fixed in version 0.148.0.
CVE-2026-100351 is an authentication bypass vulnerability in the kin-openapi library's openapi3filter.ValidationHandler.Middleware. It arises when a downstream gorilla/mux router uses UseEncodedPath(), causing a mismatch between the decoded path used for validation and the encoded path used for routing. This allows an unauthenticated request with an encoded path to bypass authentication and reach a protected handler. The issue affects kin-openapi versions from 0.144.0 up to but not including 0.147.0. The vulnerability can lead to unauthorized execution of protected handlers without invoking the authentication callback.
CVE-2026-100349 is a NULL pointer dereference vulnerability in the kin-openapi library (github.com/getkin/kin-openapi) affecting versions up to 0.145.0. The issue occurs when a response header in an OpenAPI spec declares a 'content' field instead of a 'schema', causing the ValidateResponse function to panic due to a nil pointer dereference. This crash happens even though the document passes validation, leading to a process crash on every call to the affected operation. The vulnerability can cause denial of service if the spec is attacker-controlled or comes from an untrusted source.
CVE-2026-100350 is a medium severity vulnerability in the getkin kin-openapi library affecting versions >=0.145.0 and <0.146.0. It involves uncontrolled resource consumption due to repeated compilation of an invariant regular expression inside a loop over all query keys when decoding deepObject-style query parameters. This causes CPU usage to scale linearly with the number of query keys, enabling denial of service by sending requests with many junk query keys.
CVE-2026-100347 is a medium-severity vulnerability in the getkin kin-openapi library's openapi3filter.ValidationHandler middleware. It occurs because the legacy router matches HTTP methods verbatim against a trie of upper-cased standard methods, causing requests with non-standard or non-canonical HTTP methods (e.g., PROPFIND or lowercase get) to miss the route and trigger a panic. This panic happens before authentication, leading to an unauthenticated, remotely triggerable denial of service via connection aborts and unbounded error log growth. The vulnerability affects versions prior to 0.145.0 and has no known fixes or patches as of the published date.
CVE-2026-100348 is a medium severity vulnerability in the kin-openapi library's openapi3 loader component. It involves a NULL pointer dereference in the resolveComponent function when processing additionalProperties in schema references. This occurs because the code dereferences c.Value.AdditionalProperties without checking if c.Value is nil, leading to a panic during loading of crafted OpenAPI documents. The issue affects kin-openapi versions prior to 0.145.0 and can cause denial of service by crashing applications that load untrusted OpenAPI specifications.
kin-openapi versions from 0.136.0 up to but not including 0.143.0 contain a vulnerability where the openapi3filter component improperly handles OpenAPI 3.1 array schemas missing the 'items' keyword. This leads to a nil-pointer panic during request or response validation when decoding certain content types. The issue does not affect OpenAPI 3.0 documents. The vulnerability is fixed in version 0.143.0.
CVE-2026-77354 is a high-severity vulnerability in the Go project kin-openapi affecting versions from 0.124.0 up to but not including 0.142.0. The issue involves uncontrolled resource consumption caused by the openapi3filter.sliceMapToSlice function, which allocates large slices based on attacker-controlled sparse indexes in deepObject query parameters before schema validation. This can lead to multi-gigabyte heap allocations, resulting in out-of-memory (OOM) kills or restart loops. The vulnerability is fixed in version 0.142.0.
A NULL pointer dereference vulnerability exists in kin-openapi versions from 0.10.0 up to but not including 0.141.0. The issue occurs in the openapi3filter.convertParseError function, which dereferences a nil Parameter field without checking. This can cause applications rendering validation errors to panic when processing malformed multipart/form-data requests. The vulnerability allows unauthenticated clients to cause a denial of service by repeatedly sending such requests. The issue is fixed in version 0.141.0.
kin-openapi is a Go project for handling OpenAPI files. From 0.2.0 until 0.144.0, openapi3filter.ValidateRequest can encounter a NULL-pointer-dereference denial of service when an operation declares a content parameter whose application/json media type has no schema. In openapi3filter/req_resp_decoder.go, the default defaultContentParameterDecoder dereferences mt.Schema.Value without checking whether mt.Schema is nil, even though doc.Validate() accepts the document under OpenAPI 3.0.x and 3.1.x. A single unauthenticated request supplying the parameter value can panic request validation, causing an aborted request with log growth in the common synchronous net/http path or a full process crash in integrations without recovery. This issue is fixed in version 0.144.0.
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load() in openapi3filter/validation_handler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without checking credentials. This substitution causes every OpenAPI security requirement to be satisfied for unauthenticated requests when an application relies on ValidationHandler as its enforcement middleware. The no-op callback prevents the fail-closed ErrAuthenticationServiceMissing path from being reached and forwards the request to protected handlers that may require an API key, OAuth token, or another security scheme. This issue is fixed in version 0.144.0.