Nil Dereference Vulnerability in kin-openapi for OpenAPI Files by Getkin

CVE-2026-100348

What is CVE-2026-100348?

The kin-openapi library, utilized for handling OpenAPI files, contains a vulnerability where prior to version 0.145.0, the openapi3.Loader could dereference a nil SchemaRef.Value when resolving a self-referential additionalProperties JSON reference. This flaw occurs during the loading of an attacker-controlled OpenAPI document through methods like LoadFromData, LoadFromFile, or LoadFromURI, leading to a potential panic before document validation is completed. Notably, this issue is mitigated in version 0.145.0.

References