CVE-2026-100353
kin-openapi is a Go project for handling OpenAPI files.
Published Oct 15, 2026 · updated Oct 15, 2026
## Summary The fix for GHSA-p6wj-qrr4-pgh5 addressed a nil-pointer dereference that occurs when an OpenAPI 3.1 array schema omits the keyword (which is legal under JSON Schema 2020-12). That fix patched three decoder paths: the standalone function, the top-level array check in , and . Three additional crash paths were missed. All of them reach the unguarded method ( ) or the unguarded array branch in (line 1015): 1. **Query parameters** with and no . 2. **deepObject** query parameters containing an array property with no . 3. **URL-encoded request bodies** where the array lives inside an / / sub-schema. This path bypasses the guard added by the GHSA-p6wj-qrr4-pgh5 fix, because that guard only inspects top-level properties. Each path is triggerable by an unauthenticated client and produces a deterministic nil-pointer panic during request validation. ## Details ### Root Cause The three paths patched for GHSA-p6wj-qrr4-pgh5 each received a nil- guard: But (line 576), which handles query-parameter and urlencoded-body array decoding, has **no** such guard: immediately dereferences the schema it is handed: For the deepObject path, (line 1015) has the same gap. Its array branch recurses with (line 1028), which can be nil, and the recursive call dereferences it at line 1015: For the allOf body path, validates only top-level (line 1429-1449). But (line 1474) recursively walks / / sub-schemas and calls on their properties, which never pass through the top-level guard and reach . ## Proof of Concept ### Environment - kin-openapi v0.144.0 (cloned at tag , commit ) - Go 1.26.7 - Each PoC calls first to prove the spec is legal, then drives directly ### Path 1: Query parameter array without items Spec (query param is , no ), request : ### Path 2: deepObject nested array without items Spec (deepObject param with array property , no ), request : ### Path 3: URL-encoded body with array inside allOf (bypasses the existing fix) Spec (urlencoded body, sub-schema with array property , no
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 15, 2026 · NIST NVD
Detected
kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.149.0, three openapi3filter decoder paths that were missed by the fix for GHSA-p6wj-qrr4-pgh5 lack a nil-items guard for legal OpenAPI 3.1 array schemas. An unauthenticated remote client can trigger a deterministic nil-pointer panic through an array query parameter, a deepObject query parameter containing an array propert
Oct 15, 2026 · NIST NVD
Updated
kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.149.0, three openapi3filter decoder paths that were missed by the fix for GHSA-p6wj-qrr4-pgh5 lack a nil-items guard for legal OpenAPI 3.1 array schemas. An unauthenticated remote client can trigger a deterministic nil-pointer panic through an array query parameter, a deepObject query parameter containing an array propert
Oct 15, 2026 · GitHub Advisory Database
Updated
## Summary The fix for GHSA-p6wj-qrr4-pgh5 addressed a nil-pointer dereference that occurs when an OpenAPI 3.1 array schema omits the keyword (which is legal under JSON Schema 2020-12). That fix patched three decoder paths: the standalone function, the top-level array check in , and . Three additional crash paths were missed. All of them reach the unguarded method ( ) or the unguarded array branch
Affected
- go github.com/getkin/kin-openapi>= 0.136.0, < 0.149.0
- go github.com/getkin/kin-openapi>=0.136.0 <0.149.0
- golang github.comversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-100353
Official CVE identifier
cve.org - GitHub Advisory DatabasePackage advisoryGHSA-vrcc-3ch7-hppw
kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter
github.com - GitLab Advisory DatabasePackage advisoryCVE-2026-100353
The fix for GHSA-p6wj-qrr4-pgh5 addressed a nil-pointer dereference that occurs when an OpenAPI 3.1 array schema omits the items keyword (which is legal under JSON Schema 2020-12). That fix patched three decoder paths: the standalone parseArray function, the top-level array check in UrlencodedBodyDecoder, and MultipartBodyDecoder. Three additional crash paths were missed. All of them reach the ung
advisories.gitlab.com - GitLab Advisory DatabasePackage advisorygo/github.com/getkin/kin-openapi/CVE-2026-100353.yml
The fix for GHSA-p6wj-qrr4-pgh5 addressed a nil-pointer dereference + that occurs when an OpenAPI 3.1 array schema omits the keyword (which is + legal under JSON Schema 2020-12). That fix patched three decoder paths: the standalone + function, the top-level array check in , and + .\n\nThree additional crash paths were missed. All of them + reach the unguarded method (`openapi3filter/req_resp_deco
gitlab.com - NIST NVDVulnerability recordCVE-2026-100353
kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.149.0, three openapi3filter decoder paths that were missed by the fix for GHSA-p6wj-qrr4-pgh5 lack a nil-items guard for legal OpenAPI 3.1 array schemas. An unauthenticated remote client can trigger a de
nvd.nist.gov