Circular Reference Vulnerability in kin-openapi Go Project

CVE-2026-100354

What is CVE-2026-100354?

The kin-openapi project, a Go-based solution for managing OpenAPI files, is susceptible to a circular reference vulnerability in its validation process. Versions prior to 0.149.0 fail to detect cycles in request and response schema chains using constructs such as allOf, anyOf, or oneOf. When a circular reference occurs, it triggers unbounded recursion in the processing functions, leading to a stack overflow that crashes the application, affecting all concurrent requests. This critical issue can disrupt services and requires immediate upgrading to version 0.149.0 or later to mitigate the risk.

References