Vulnerability · CVE-2026-100347
kin-openapi is a Go project for handling OpenAPI files.
Published Oct 15, 2026 · catalog updated Oct 16, 2026 · kin-openapi is a Go
Check if you run it
No confirmed exploitation is on record for CVE-2026-100347. EPSS is 0.52%. Act only if a listed version of kin-openapi is a Go is installed.
Gaps on this record
- The stored product name is a package slug. The name on this page is taken from the title (kin-openapi is a Go).
- No vendor fix or required action is stored. Compare the linked advisory before you change production.
- Severity
- Medium5.3
- Known exploitation
- Not in CISA/VulnCheck KEV
- EPSS
- 0.52%
- Remediation
- Version ranges on file
- Affected products
- Debian:12 golang-github-getkin-kin-openapi · Debian:13 golang-github-getkin-kin-openapi · Debian:14 golang-github-getkin-kin-openapi · Go github.com/getkin/kin-openapi · go github.com/getkin/kin-openapi · golang github.com
## Summary The (the exported, documented request-validation middleware) hard-wires the legacy router ( ). That router matches the incoming request method verbatim against a trie built exclusively from upper-cased canonical HTTP methods. A request carrying a method token that is not one of the 9 standard methods — a legitimate-but-unsupported token such as , or a non-canonical case variant such as lowercase — misses the trie, leaves , and for an existing **static** path falls through to , whose case calls . The panic fires inside route resolution, **before any authentication** runs. This is an unauthenticated, remotely triggerable denial of service (recovered per-connection panic + unbounded error-log growth). ## Root Cause - — always constructs ; there is no alternative router option on this path. - — the request method is used verbatim ( ); there is no canonicalization or rejection of unknown method tokens. - — the trie is populated with keys taken from (canonical constants only). - — misses for a non-canonical/unsupported method → . - — in the block, returns non-nil for an existing static path, and control reaches . - — 's has no matching case → . ## Impact An unauthenticated attacker sends a single request with a non-standard HTTP method token to any existing static path. The handler goroutine panics; Go's recovers the panic per connection (process survives), aborts the connection (client sees a reset / 500), and logs a full stack trace. Repeated requests cause connection churn and unbounded log growth, and the request never reaches authentication. Availability impact (A:L) under the default synchronous middleware; on non-net/http hosts or when reached on an application goroutine the ceiling is a full crash. ## Proof of Concept Serve any spec with a static path (e.g. ) behind , then: Reproduced end-to-end against a real + : and lowercase both abort the connection with a panic at (stack: <- router.go:150 <- validation_handler.go:84); the process stays alive and su
Are you affected?
Enter the version you run. The result uses only the ranges stored on this record.
The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.
- Debian:12 golang-github-getkin-kin-openapi0.110.0-1, 0.117.0-1, 0.118.0-1
- Debian:13 golang-github-getkin-kin-openapi0.124.0-1, 0.135.0-1
- Debian:14 golang-github-getkin-kin-openapi0.124.0-1, 0.135.0-1
- Go github.com/getkin/kin-openapi0 → 0.145.0
- go github.com/getkin/kin-openapi<= 0.144.0
- golang github.comversion unspecified
How to fix CVE-2026-100347
Recommended remediation
Affected version ranges suggest a fixed boundary. Verify against the vendor advisory for your release.
Official advisories
What to do
Three questions, each answered from this record only. Confirm the vendor advisory before you patch.
Should you patch?
No confirmed exploitation is on record for CVE-2026-100347. EPSS is 0.52%. Act only if a listed version of kin-openapi is a Go is installed.
Which versions are affected?
Compare what you have installed with 0.110.0-1, 0.117.0-1, 0.118.0-1, 0.124.0-1, 0.135.0-1, 0 → 0.145.0, <= 0.144.0. Compare the installed version with the linked vendor advisory before you change production.
What should an analyst verify?
CWE-20: Improper Input Validation; CWE-248. EPSS 0.52%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.
Technology hubs
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 15, 2026 · NIST NVD
Detected
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3filter.ValidationHandler uses the routers/legacy router, which passes an unsupported or non-canonical HTTP method for an existing static path to openapi3.PathItem.GetOperation. The default branch of GetOperation panics before authentication runs, so an unauthenticated remote client can repeatedly send methods such as
Oct 15, 2026 · NIST NVD
Updated
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3filter.ValidationHandler uses the routers/legacy router, which passes an unsupported or non-canonical HTTP method for an existing static path to openapi3.PathItem.GetOperation. The default branch of GetOperation panics before authentication runs, so an unauthenticated remote client can repeatedly send methods such as
Oct 15, 2026 · GitHub Advisory Database
Fix available
github.com/getkin/kin-openapi fixed in 0.145.0
Oct 15, 2026 · GitHub Advisory Database
Fix available
github.com/getkin/kin-openapi fixed in 0.145.0
Oct 15, 2026 · GitHub Advisory Database
Updated
## Summary The (the exported, documented request-validation middleware) hard-wires the legacy router ( ). That router matches the incoming request method verbatim against a trie built exclusively from upper-cased canonical HTTP methods. A request carrying a method token that is not one of the 9 standard methods — a legitimate-but-unsupported token such as , or a non-canonical case variant such as
Oct 16, 2026 · OpenSSF OSV / OSV Scanner
Updated
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3filter.ValidationHandler uses the routers/legacy router, which passes an unsupported or non-canonical HTTP method for an existing static path to openapi3.PathItem.GetOperation. The default branch of GetOperation panics before authentication runs, so an unauthenticated remote client can repeatedly send methods such as
Sources
- CVE.orgVulnerability recordCVE-2026-100347
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-100347
30-day exploitation probability 0.5%
first.org - GitHub Advisory DatabasePackage advisoryGHSA-fh4f-47mf-f2gj
kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static path
github.com - GitLab Advisory DatabasePackage advisoryCVE-2026-100347
The openapi3filter.ValidationHandler (the exported, documented request-validation middleware) hard-wires the legacy router (routers/legacy). That router matches the incoming request method verbatim against a trie built exclusively from upper-cased canonical HTTP methods. A request carrying a method token that is not one of the 9 standard methods — a legitimate-but-unsupported token such as PROPFIN
advisories.gitlab.com - NIST NVDVulnerability recordCVE-2026-100347
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3filter.ValidationHandler uses the routers/legacy router, which passes an unsupported or non-canonical HTTP method for an existing static path to openapi3.PathItem.GetOperation. The default branch of
nvd.nist.gov - OpenSSF OSV / OSV ScannerPackage advisoryDEBIAN-CVE-2026-100347osv.dev
- OpenSSF OSV / OSV ScannerPackage advisoryGHSA-fh4f-47mf-f2gj
kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static path
osv.dev
References
Freshness
Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.