Nil Pointer Panic Vulnerability in kin-openapi from Getkin

CVE-2026-97394

What is CVE-2026-97394?

The kin-openapi project, which facilitates processing of OpenAPI files, contains a vulnerability affecting versions 0.136.0 to 0.143.0. This flaw arises when openapi3filter erroneously accepts OpenAPI 3.1 array schemas that lack an 'items' keyword. In this scenario, a remote unauthenticated client can exploit the flaw by triggering a nil pointer panic during the validation of requests or responses, specifically when decoding application/x-www-form-urlencoded or multipart/form-data bodies. OpenAPI 3.0 documents are safe from this issue as they do not allow such schemas. The vulnerability has been addressed in version 0.143.0.

References