CVE-2026-97394: getkin kin-openapi Uncaught Exception

Vulnerability summary

CVE-2026-97394 is a high (CVSS 7.5) Uncaught Exception vulnerability in getkin kin-openapi. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 35.5% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 15-10-2026
   PublishedVulnerability first disclosed.
2. 20-10-2026
   Last modifiedVulnerability information updated.

Description

kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.143.0, openapi3filter accepts OpenAPI 3.1 array schemas without an items keyword and then dereferences the nil Schema.Items value while decoding application/x-www-form-urlencoded or multipart/form-data request bodies, response headers, and other array parameter surfaces. A remote unauthenticated client can reach an affected operation with a nonempty request or matching response and deterministically trigger a nil-pointer panic during ValidateRequest or ValidateResponse. OpenAPI 3.0 documents are not affected because document validation rejects arrays without items, and JSON request bodies use a different decoder path. This issue is fixed in version 0.143.0.

• CWE-248Uncaught ExceptionAn exception is thrown from a function, but it is not caught.
• CWE-476NULL Pointer DereferenceThe product dereferences a pointer that it expects to be valid but is NULL.