ZeroDay Findings
Sign inSign up

Findings

CVE-2026-97394

kin-openapi is a Go project for handling OpenAPI files.

Published Oct 15, 2026 · updated Oct 15, 2026

### Summary A nil-pointer dereference in lets any unauthenticated client crash a request handler with a single HTTP request against an OpenAPI **3.1** operation that declares **without** . OpenAPI 3.1 (JSON Schema 2020-12) permits omitting , and accepts such schemas with . Request/response decoders then dereference with no nil check. The panic is **deterministic (100%)** on every request to the affected operation. There is no in ; under handlers without per-request recover the process can exit. ### Details **Spec-validation asymmetry.** OpenAPI 3.0 rejects array schemas that omit ([ ](https://github.com/getkin/kin-openapi/blob/master/openapi3/schema.go) around the / branch). For OpenAPI 3.1, enables , so that check is skipped and remains nil after a clean . **Vulnerable decoder.** The primary request-side crash is in [ ](https://github.com/getkin/kin-openapi/blob/master/openapi3filter/req_resp_decoder.go) (still present on this checkout at L1421): This runs during schema inspection **before** form values are parsed. Any non-empty body for the operation reaches the dereference (an empty body is rejected earlier when is true, and never enters the decoder). The same nil also crashes: | Path | Location | Trigger | |---|---|---| | | ~1564 → 1579 | part named like the array property | | → | ~1129 / 1151 | Array-typed **response headers** via , and path/cookie array params | / call / directly with no recover, so the panic escapes the library into the application. **Recommended fix.** Guard nil and return a structured decode/validation error, e.g.: Apply equivalent guards in and before calling . ### PoC Verified against revision , Go 1.25, . **1. Spec** — OpenAPI 3.1 operation with urlencoded body and property without : **2. E2E program** — server using the same public entrypoint ( → ) real middleware uses. Save as in a module that depends on at a vulnerable revision, then : **3. Observed output** ( ): Then: Server log: Stack pins the fault to at , called from → → . **Attac

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 15, 2026 · NIST NVD

    Detected

    kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.143.0, openapi3filter accepts OpenAPI 3.1 array schemas without an items keyword and then dereferences the nil Schema.Items value while decoding application/x-www-form-urlencoded or multipart/form-data request bodies, response headers, and other array parameter surfaces. A remote unauthenticated client can reach an affect

  2. Oct 15, 2026 · NIST NVD

    Updated

    kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.143.0, openapi3filter accepts OpenAPI 3.1 array schemas without an items keyword and then dereferences the nil Schema.Items value while decoding application/x-www-form-urlencoded or multipart/form-data request bodies, response headers, and other array parameter surfaces. A remote unauthenticated client can reach an affect

  3. Oct 15, 2026 · GitHub Advisory Database

    Fix available

    github.com/getkin/kin-openapi fixed in 0.143.0

  4. Oct 15, 2026 · GitHub Advisory Database

    Fix available

    github.com/getkin/kin-openapi fixed in 0.143.0

  5. Oct 15, 2026 · GitHub Advisory Database

    Updated

    ### Summary A nil-pointer dereference in lets any unauthenticated client crash a request handler with a single HTTP request against an OpenAPI **3.1** operation that declares **without** . OpenAPI 3.1 (JSON Schema 2020-12) permits omitting , and accepts such schemas with . Request/response decoders then dereference with no nil check. The panic is **deterministic (100%)** on every request to the af

Affected

  • Go github.com/getkin/kin-openapi0.136.0 → 0.143.0

Sources

  • CVE.orgVulnerability recordCVE-2026-97394

    Official CVE identifier

    cve.org
  • GitHub Advisory DatabasePackage advisoryGHSA-p6wj-qrr4-pgh5

    GitHub Advisory Database record mirrored by OSV.

    github.com
  • NIST NVDVulnerability recordCVE-2026-97394

    kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.143.0, openapi3filter accepts OpenAPI 3.1 array schemas without an items keyword and then dereferences the nil Schema.Items value while decoding application/x-www-form-urlencoded or multipart/form-data r

    nvd.nist.gov
  • OSV.devPackage advisoryGHSA-p6wj-qrr4-pgh5

    kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing items

    osv.dev

References