OpenAPI File Handling Vulnerability in kin-openapi by Getkin

CVE-2026-100350

What is CVE-2026-100350?

The kin-openapi project, which is designed to handle OpenAPI files, has a vulnerability that allows unauthenticated remote clients to exploit inefficient handling of deepObject query parameters. Specifically, from versions 0.145.0 to 0.146.0, the openapi3filter component repeatedly compiles a fixed regular expression without caching, leading to excessive resource consumption. Attackers can send multiple unrelated query keys in their requests, causing the ValidateRequest function to perform work proportional to the number of keys, resulting in potential denial of service due to resource exhaustion. This vulnerability has been addressed in version 0.146.0.

References