ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-100354

kin-openapi is a Go project for handling OpenAPI files.

Published Oct 15, 2026 · catalog updated Oct 15, 2026 · kin-openapi is a Go

Check if you run it

No confirmed exploitation is on record for CVE-2026-100354. EPSS is 0.43%. Act only if a listed version of kin-openapi is a Go is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (kin-openapi is a Go).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
High7.5
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.43%
Remediation
Version ranges on file
Affected products
go github.com/getkin/kin-openapi · golang github.com

## Summary kin-openapi's spec loader and spec-time validator both handle circular schema references safely: the loader resolves circular s on purpose (to support recursive data structures), and uses stack-based cycle detection. therefore accepts a schema whose / / chain refers back to itself, returning no error. The runtime validators do not have that protection. When such a schema is used for request or response validation, the recursion through the combinator chain is unbounded. In Go this produces a **fatal stack overflow** ( / ), which is **not** a recoverable panic. cannot catch it, so 's per-connection recovery does not help. The entire process is terminated, including all goroutines serving unrelated clients. Two independent unguarded recursion sites were confirmed: 1. — / (reached by , i.e. response validation and direct schema validation). 2. — (reached first during request parameter decoding). The report also identifies the same gap in and / . ## Details ### Root Cause has cycle detection ( ): The runtime visitor has none. (line 1951) calls (line 2189), which iterates the combinator slice and calls again on each sub-schema: The request-decoding path has the same structure in ( ): ## Proof of Concept ### Environment - kin-openapi v0.144.0 (tag , commit ) - Go 1.26.7 ### Path A: response / direct schema validation ( ) A schema whose refers to itself. is called first to show the schema is accepted, then : Output: A placed around the call did **not** catch the fatal error — the process aborted with a non-zero exit code, confirming it is unrecoverable. ### Path B: HTTP request validation against a loaded spec (realistic delivery) A legal OAS 3.0 spec with a circular , loaded normally, served behind a standard handler using : A single crashes the whole server process: The line printed after the request ("the process survived") was never reached, and the process exited with a non-zero code — the standard per-connection did not save it. This is the key distinction

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • go github.com/getkin/kin-openapi< 0.149.0
  • go github.com/getkin/kin-openapi<0.149.0
  • golang github.comversion unspecified

How to fix CVE-2026-100354

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-100354. EPSS is 0.43%. Act only if a listed version of kin-openapi is a Go is installed.

Which versions are affected?

Compare what you have installed with < 0.149.0, <0.149.0. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-674. EPSS 0.43%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 15, 2026 · NIST NVD

    Detected

    kin-openapi is a Go project for handling OpenAPI files. Prior to 0.149.0, runtime request, response, and direct schema validation lacks cycle detection when an allOf, anyOf, or oneOf chain refers back to an ancestor schema, even though loading and document validation accept the circular reference. A request or response that reaches the affected schema causes unbounded recursion in Schema.visitJSON

  2. Oct 15, 2026 · NIST NVD

    Updated

    kin-openapi is a Go project for handling OpenAPI files. Prior to 0.149.0, runtime request, response, and direct schema validation lacks cycle detection when an allOf, anyOf, or oneOf chain refers back to an ancestor schema, even though loading and document validation accept the circular reference. A request or response that reaches the affected schema causes unbounded recursion in Schema.visitJSON

  3. Oct 15, 2026 · NIST NVD

    Updated

    kin-openapi is a Go project for handling OpenAPI files. Prior to 0.149.0, runtime request, response, and direct schema validation lacks cycle detection when an allOf, anyOf, or oneOf chain refers back to an ancestor schema, even though loading and document validation accept the circular reference. A request or response that reaches the affected schema causes unbounded recursion in Schema.visitJSON

  4. Oct 15, 2026 · GitHub Advisory Database

    Updated

    ## Summary kin-openapi's spec loader and spec-time validator both handle circular schema references safely: the loader resolves circular s on purpose (to support recursive data structures), and uses stack-based cycle detection. therefore accepts a schema whose / / chain refers back to itself, returning no error. The runtime validators do not have that protection. When such a schema is used for req

Sources

  • CVE.orgVulnerability recordCVE-2026-100354

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-100354

    30-day exploitation probability 0.4%

    first.org
  • GitHub Advisory DatabasePackage advisoryGHSA-g8cf-rcjf-c8cf

    kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crash

    github.com
  • GitLab Advisory DatabasePackage advisoryCVE-2026-100354

    kin-openapi's spec loader and spec-time validator both handle circular schema references safely: the loader resolves circular $refs on purpose (to support recursive data structures), and Schema.validate() uses stack-based cycle detection. Validate() therefore accepts a schema whose allOf / anyOf / oneOf chain refers back to itself, returning no error. The runtime validators do not have that protec

    advisories.gitlab.com
  • GitLab Advisory DatabasePackage advisorygo/github.com/getkin/kin-openapi/CVE-2026-100354.yml

    kin-openapi's spec loader and spec-time validator both handle circular + schema references safely: the loader resolves circular s on purpose (to support + recursive data structures), and uses stack-based cycle detection. + therefore accepts a schema whose / / chain + refers back to itself, returning no error.\n\nThe runtime validators do not have + that protection. When such a schema is used for r

    gitlab.com
  • NIST NVDVulnerability recordCVE-2026-100354

    kin-openapi is a Go project for handling OpenAPI files. Prior to 0.149.0, runtime request, response, and direct schema validation lacks cycle detection when an allOf, anyOf, or oneOf chain refers back to an ancestor schema, even though loading and document validation accept the c

    nvd.nist.gov

References

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.