CVE-2026-100350
kin-openapi is a Go project for handling OpenAPI files.
Published Oct 15, 2026 · updated Oct 15, 2026
### Summary decodes -style query parameters by looping over **every** key in the request's query string. Inside that loop it recompiles a **loop-invariant** regular expression on every iteration. The pattern depends only on the spec-defined parameter name, not on the loop variable, so it is compiled times for query keys instead of once. Because the number of query keys is attacker-controlled and unbounded, a single request with many junk query keys forces a proportional number of calls, consuming CPU. A handful of concurrent requests can saturate all cores — an uncontrolled-resource-consumption denial of service. This is **not** ReDoS: the pattern is fixed ( ) and matches in linear time. The cost is the **repeated compilation** of an invariant regexp, once per attacker-supplied query key. ### Details In , the branch of builds a per-parameter property map by iterating over all query keys: The regexp built at depends only on — the parameter name defined in the OpenAPI spec — which is **constant** for the whole loop. Yet is invoked inside the loop at , so it is recompiled once for every key present in the query string. Contrast this with the already-hoisted, package-level regexp used two lines below: is compiled exactly once at package init and reused. The per-parameter pattern at should be compiled the same way (once, outside the loop), but instead is rebuilt on every iteration. costs on the order of a few microseconds per call. The number of iterations equals the number of query keys , which the client fully controls (a ~1 MB URL holds roughly 100k keys). For each parameter defined on the matched route, the request performs compilations. The work is CPU-bound, happens during request validation before any handler logic, and scales linearly with request size, so an attacker converts cheap request bytes into expensive server CPU. Affected code path: → → → (the case). Any operation with at least one , parameter is exploitable. ### PoC The following self-contained test (p
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 15, 2026 · NIST NVD
Detected
kin-openapi is a Go project for handling OpenAPI files. From 0.145.0 until 0.146.0, openapi3filter repeatedly calls regexp.MustCompile for the same parameter-name regular expression inside the per-query-key loop in urlValuesDecoder.DecodeObject used to decode a deepObject query parameter. An unauthenticated remote client can send an affected endpoint a request containing many unrelated query keys,
Oct 15, 2026 · NIST NVD
Updated
kin-openapi is a Go project for handling OpenAPI files. From 0.145.0 until 0.146.0, openapi3filter repeatedly calls regexp.MustCompile for the same parameter-name regular expression inside the per-query-key loop in urlValuesDecoder.DecodeObject used to decode a deepObject query parameter. An unauthenticated remote client can send an affected endpoint a request containing many unrelated query keys,
Oct 15, 2026 · NIST NVD
Updated
kin-openapi is a Go project for handling OpenAPI files. From 0.145.0 until 0.146.0, openapi3filter repeatedly calls regexp.MustCompile for the same parameter-name regular expression inside the per-query-key loop in urlValuesDecoder.DecodeObject used to decode a deepObject query parameter. An unauthenticated remote client can send an affected endpoint a request containing many unrelated query keys,
Oct 15, 2026 · GitHub Advisory Database
Fix available
github.com/getkin/kin-openapi fixed in 0.146.0
Oct 15, 2026 · GitHub Advisory Database
Fix available
github.com/getkin/kin-openapi fixed in 0.146.0
Oct 15, 2026 · GitHub Advisory Database
Updated
### Summary decodes -style query parameters by looping over **every** key in the request's query string. Inside that loop it recompiles a **loop-invariant** regular expression on every iteration. The pattern depends only on the spec-defined parameter name, not on the loop variable, so it is compiled times for query keys instead of once. Because the number of query keys is attacker-controlled and u
Affected
- Go github.com/getkin/kin-openapi0.145.0 → 0.146.0
- go github.com/getkin/kin-openapi>= 0.145.0, < 0.146.0
- golang github.comversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-100350
Official CVE identifier
cve.org - GitHub Advisory DatabasePackage advisoryGHSA-h4r5-mxv5-8mjc
GitHub Advisory Database record mirrored by OSV.
github.com - GitLab Advisory DatabasePackage advisoryCVE-2026-100350
openapi3filter decodes deepObject-style query parameters by looping over every key in the request's query string. Inside that loop it recompiles a loop-invariant regular expression on every iteration. The pattern depends only on the spec-defined parameter name, not on the loop variable, so it is compiled N times for N query keys instead of once. Because the number of query keys is attacker-control
advisories.gitlab.com - NIST NVDVulnerability recordCVE-2026-100350
kin-openapi is a Go project for handling OpenAPI files. From 0.145.0 until 0.146.0, openapi3filter repeatedly calls regexp.MustCompile for the same parameter-name regular expression inside the per-query-key loop in urlValuesDecoder.DecodeObject used to decode a deepObject query p
nvd.nist.gov - OSV.devPackage advisoryGHSA-h4r5-mxv5-8mjc
kin-openapi deepObject query decoding repeatedly compiles an invariant regular expression
osv.dev