Nil-Pointer Panic Vulnerability in kin-openapi by getkin

CVE-2026-100353

What is CVE-2026-100353?

The kin-openapi project has a vulnerability affecting versions 0.136.0 through 0.149.0, related to the handling of OpenAPI 3.1 array schemas. Certain decoder paths lack a nil-items guard, allowing a remote unauthenticated client to trigger a nil-pointer panic. This can occur via specific query parameters or request bodies, leading to application instability. The issue has been addressed in version 0.149.0. For more information on the vulnerability and its fix, refer to the official advisory and release notes.

References