Vulnerability · Published Oct 15, 2026 · Assigned by GitHub_M
CVE-2026-100350kin-openapi deepObject query decoding repeatedly compiles an invariant regular expression
Medium 5.3
In plain English
A medium-severity uncontrolled resource consumption in kin-openapi from getkin. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 39% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
kin-openapi is a Go project for handling OpenAPI files. From 0.145.0 until 0.146.0, openapi3filter repeatedly calls regexp.MustCompile for the same parameter-name regular expression inside the per-query-key loop in urlValuesDecoder.DecodeObject used to decode a deepObject query parameter. An unauthenticated remote client can send an affected endpoint a request containing many unrelated query keys, causing ValidateRequest to perform work and allocations proportional to the attacker-controlled key count for every deepObject parameter. The expression itself is fixed and this is not regular expression denial of service; the resource consumption comes from loop-invariant recompilation. This issue is fixed in version 0.146.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/getkin/kin-openapi | 0.146.0 | GHSA-h4r5-mxv5-8mjc |
| Go | github.com/getkin/kin-openapi | 0.146.0 | GO-2026-6787 |
| Ubuntu:22.04:LTS | golang-github-getkin-kin-openapi | no fix listed | UBUNTU-CVE-2026-100350 |
| Ubuntu:24.04:LTS | golang-github-getkin-kin-openapi | no fix listed | UBUNTU-CVE-2026-100350 |
| Ubuntu:26.04:LTS | golang-github-getkin-kin-openapi | no fix listed | UBUNTU-CVE-2026-100350 |
| Ubuntu:26.10 | golang-github-getkin-kin-openapi | no fix listed | UBUNTU-CVE-2026-100350 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| getkin | kin-openapi | >= 0.145.0, < 0.146.0 |
Weakness: CWE-400, CWE-770, CWE-1050 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L