Multiple security vulnerabilities have been identified in kin-openapi, an OpenAPI parsing and validation library used by Go applications. The issues affect request validation, schema loading, query decoding, and security enforcement, and can allow unauthenticated attackers to cause denial of service or bypass validation controls. The combination of denial-of-service and validation bypass issues makes exposed API gateways and services especially vulnerable.
CVE-2026-97394 (CVSS 7.5 — High): A nil-pointer dereference in the request validation component can panic when processing OpenAPI 3.1 array schemas that omit item definitions. An unauthenticated attacker can trigger the crash with a single crafted HTTP request to an affected operation.[/subscribe_to_unlock_form]
Multiple security vulnerabilities have been identified in kin-openapi, an OpenAPI parsing and validation library used by Go applications. The issues affect request validation, schema loading, query decoding, and security enforcement, and can allow unauthenticated attackers to cause denial of service or bypass validation controls. The combination of denial-of-service and validation bypass issues makes exposed API gateways and services especially vulnerable.
CVE-2026-97394 (CVSS 7.5 — High): A nil-pointer dereference in the request validation component can panic when processing OpenAPI 3.1 array schemas that omit item definitions. An unauthenticated attacker can trigger the crash with a single crafted HTTP request to an affected operation.[emaillocker id="1283"]
CVE-2026-100347 (CVSS 5.3 — Medium): The legacy router can panic when a static path is reached with a non-canonical or unsupported HTTP method. An unauthenticated attacker can send such a request to cause a denial of service.
CVE-2026-100348 (CVSS 5.3 — Medium): The specification loader can panic on a self-referential additionalProperties reference due to a nil-pointer condition. An attacker who can supply or influence an OpenAPI document can trigger the denial of service.
CVE-2025-30153: This identifier is included in the affected set, but no flaw description, affected component, or exploitation details are available.
CVE-2026-100350 (CVSS 5.3 — Medium): The deepObject query decoding component repeatedly compiles an invariant regular expression while processing query parameters. An attacker can cause inefficient processing and a denial of service by sending repeated or crafted query input.
CVE-2026-100351 (CVSS 7.4 — High): The validation handler can be confused by encoded path values, causing the wrong operation to be selected. This can bypass security requirements and allow an attacker to access an operation without the intended authorization.
CVE-2026-100352 (CVSS 7.5 — High): YAML values representing NaN or infinity can bypass built-in guards in the OpenAPI 3.1 validation path and cause a panic. An attacker who can supply a crafted OpenAPI document can trigger a denial of service.
CVE-2026-100354 (CVSS 7.5 — High): Circular allOf, anyOf, or oneOf schema relationships can cause uncontrolled recursion during schema validation. An attacker who can supply a crafted OpenAPI document can crash the process.
CVE-2026-100353 (CVSS 7.5 — High): Additional nil-item panic paths exist in request validation for array schemas that omit item definitions. An unauthenticated attacker can trigger a crash through other affected validation paths.
These vulnerabilities collectively present a significant risk to applications that validate OpenAPI requests or load untrusted API definitions. Services exposed to untrusted network input, especially API gateways and request validation middleware, are most at risk. The appropriate response is to prioritize these issues in risk management and restrict exposure of affected components.
We recommend you to update github.com/getkin/kin-openapi to version 0.143.0, 0.146.0, 0.147.0, 0.148.0, or 0.149.0.
The following reports contain further technical details: