Vulnerability · Published Oct 15, 2026 · Assigned by GitHub_M
CVE-2026-100353kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter
High 7.5
In plain English
A high-severity null pointer dereference in kin-openapi from getkin. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.149.0, three openapi3filter decoder paths that were missed by the fix for GHSA-p6wj-qrr4-pgh5 lack a nil-items guard for legal OpenAPI 3.1 array schemas. An unauthenticated remote client can trigger a deterministic nil-pointer panic through an array query parameter, a deepObject query parameter containing an array property, or an application/x-www-form-urlencoded request body whose array property appears inside an allOf, anyOf, or oneOf subschema. The query and composed-body paths reach urlValuesDecoder.parseArray, while the deepObject path reaches buildResObj, and all pass a nil items schema into code that dereferences it. This issue is fixed in version 0.149.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/getkin/kin-openapi | 0.149.0 | GHSA-vrcc-3ch7-hppw |
| Go | github.com/getkin/kin-openapi | 0.149.0 | GO-2026-6800 |
| Ubuntu:22.04:LTS | golang-github-getkin-kin-openapi | no fix listed | UBUNTU-CVE-2026-100353 |
| Ubuntu:24.04:LTS | golang-github-getkin-kin-openapi | no fix listed | UBUNTU-CVE-2026-100353 |
| Ubuntu:26.04:LTS | golang-github-getkin-kin-openapi | no fix listed | UBUNTU-CVE-2026-100353 |
| Ubuntu:26.10 | golang-github-getkin-kin-openapi | no fix listed | UBUNTU-CVE-2026-100353 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| getkin | kin-openapi | >= 0.136.0, < 0.149.0 |
Weakness: CWE-476 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H