OpenAPI Vulnerability in kin-openapi by GetKin
CVE-2026-100347

5.3MEDIUM

Key Information:

Vendor

Getkin

Status
Kin-openapi
Vendor
CVE Published:
15 October 2026

What is CVE-2026-100347?

The kin-openapi project, which facilitates OpenAPI file handling, contains a vulnerability in its openapi3filter.ValidationHandler prior to version 0.145.0. This issue arises from the use of the routers/legacy router that processes unsupported or non-canonical HTTP methods on static paths. As a result, it can lead to a panic situation before authentication occurs when an unauthenticated remote client sends requests like PROPFIND or lowercase GET, potentially aborting connections and causing excessive stack-trace log growth. This vulnerability is mitigated in version 0.145.0, which addresses the input validation flaws within the affected code.

Affected Version(s)

kin-openapi < 0.145.0

References

https://github.com/getkin/kin-openapi/security/advisories...
x_refsource_CONFIRM
https://github.com/getkin/kin-openapi/commit/f1a5b523b828...
x_refsource_MISC
https://github.com/getkin/kin-openapi/releases/tag/v0.145.0
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.