CVE-2026-100352: getkin kin-openapi

Vulnerability summary

CVE-2026-100352 is a high (CVSS 7.5) vulnerability in getkin kin-openapi. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 35.5% of scored vulnerabilities.

Timeline

1. 15-10-2026
   PublishedVulnerability first disclosed.
2. 20-10-2026
   Last modifiedVulnerability information updated.

Description

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.148.0, the OpenAPI 3.1 validation path passes YAML NaN and infinity numeric values to santhosh-tekuri/jsonschema v6.0.2 without applying kin-openapi's existing finite-number guards. A remote unauthenticated client can send an application/yaml or application/x-yaml request body containing .nan, .inf, or -.inf to an operation with a numeric constraint, causing the dependency to create and dereference a nil big.Rat during ValidateRequest. Standard net/http servers recover the panic per connection, while other hosts or application goroutines may terminate the process. This issue is fixed in version 0.148.0.

• CWE-754Improper Check for Unusual or Exceptional ConditionsThe product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.