OpenAPI Validation Vulnerability in Kin-OpenAPI by Getkin

CVE-2026-100352

What is CVE-2026-100352?

The kin-openapi library, a Go project for processing OpenAPI files, contains a vulnerability affecting its OpenAPI 3.1 validation mechanism. This issue allows remote unauthenticated clients to exploit the library by sending invalid YAML numeric values such as .nan and .inf. Without proper validation, these values can lead to unexpected behavior and possible termination of application processes due to a nil pointer dereference in the dependent jsonschema library. This vulnerability is addressed in version 0.148.0 of kin-openapi, which implements necessary guards against such input.

References