CVE-2026-100352
kin-openapi is a Go project for handling OpenAPI files.
Published Oct 15, 2026 · updated Oct 15, 2026
## Summary kin-openapi guards against and values in its built-in schema visitor ( ) by returning / when a input violates those constraints. For OAS 3.1 specs, however, routes through , which hands the value directly to v6.0.2 without applying the same guard. Inside v6.0.2, builds a from the input via . For / this parse fails silently and returns . then dereferences the nil (in ), producing a Go runtime panic. An attacker delivers this by sending an HTTP request with (or ) and a YAML body containing , , or . The decodes those tokens into / (standard YAML 1.2 behavior), and they propagate to the unguarded path whenever the schema declares a numeric constraint ( , , , , or ). ## Details ### Root Cause The built-in visitor at guards NaN/Inf explicitly: For OAS 3.1 specs, dispatches to ( ), which contains no such guard: calls (line 146), which reaches in v6.0.2. There, returns for / , and the code dereferences the in , causing the panic. ## Proof of Concept ### Environment - kin-openapi v0.144.0 (tag , commit ) - santhosh-tekuri/jsonschema/v6 v6.0.2 (transitive dep) - Go 1.26.7 ### Spec Minimal OAS 3.1 spec ( ) declaring a YAML body with a numeric constraint: ### Trigger A single with and body , , or . All three variants panic: ### Panic stack trace (confirms exact chain) ### net/http behavior (severity nuance) Behind a standard server, the panic is recovered per-connection. The client sees a dropped connection; the server process continues: This is a **recoverable panic**, unlike the recursion finding. catches it (verified by capturing the panic value in a in the same goroutine). Non- hosts or validation performed in an application-spawned goroutine are not covered by that recovery and would experience a full-process crash. ### Fix verification Upgrading only the transitive dependency to (via ) eliminates the panic entirely; all three payloads return a clean validation error: This confirms the upstream v6.0.3 release treats the NaN/Inf case as a bug and fixes it at the
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 15, 2026 · NIST NVD
Detected
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.148.0, the OpenAPI 3.1 validation path passes YAML NaN and infinity numeric values to santhosh-tekuri/jsonschema v6.0.2 without applying kin-openapi's existing finite-number guards. A remote unauthenticated client can send an application/yaml or application/x-yaml request body containing .nan, .inf, or -.inf to an operation with a
Oct 15, 2026 · NIST NVD
Updated
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.148.0, the OpenAPI 3.1 validation path passes YAML NaN and infinity numeric values to santhosh-tekuri/jsonschema v6.0.2 without applying kin-openapi's existing finite-number guards. A remote unauthenticated client can send an application/yaml or application/x-yaml request body containing .nan, .inf, or -.inf to an operation with a
Oct 15, 2026 · GitHub Advisory Database
Fix available
github.com/getkin/kin-openapi fixed in 0.148.0
Oct 15, 2026 · GitHub Advisory Database
Fix available
github.com/getkin/kin-openapi fixed in 0.148.0
Oct 15, 2026 · GitHub Advisory Database
Updated
## Summary kin-openapi guards against and values in its built-in schema visitor ( ) by returning / when a input violates those constraints. For OAS 3.1 specs, however, routes through , which hands the value directly to v6.0.2 without applying the same guard. Inside v6.0.2, builds a from the input via . For / this parse fails silently and returns . then dereferences the nil (in ), producing a Go ru
Affected
- Go github.com/getkin/kin-openapi0 → 0.148.0
- go github.com/getkin/kin-openapi< 0.148.0
- golang github.comversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-100352
Official CVE identifier
cve.org - GitHub Advisory DatabasePackage advisoryGHSA-rj39-cv6w-8wv7
GitHub Advisory Database record mirrored by OSV.
github.com - GitLab Advisory DatabasePackage advisoryCVE-2026-100352
kin-openapi guards against NaN and Inf values in its built-in schema visitor (visitJSON) by returning ErrSchemaInputNaN / ErrSchemaInputInf when a float64 input violates those constraints. For OAS 3.1 specs, however, Schema.VisitJSON routes through useJSONSchema2020, which hands the value directly to santhosh-tekuri/jsonschema/v6 v6.0.2 without applying the same guard. Inside jsonschema/v6 v6.0.2,
advisories.gitlab.com - NIST NVDVulnerability recordCVE-2026-100352
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.148.0, the OpenAPI 3.1 validation path passes YAML NaN and infinity numeric values to santhosh-tekuri/jsonschema v6.0.2 without applying kin-openapi's existing finite-number guards. A remote unauthenticated client
nvd.nist.gov - OSV.devPackage advisoryGHSA-rj39-cv6w-8wv7
kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path
osv.dev