ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-97394

kin-openapi is a Go project for handling OpenAPI files.

Published Oct 15, 2026 · catalog updated Oct 15, 2026 · kin-openapi is a Go

Check if you run it

No confirmed exploitation is on record for CVE-2026-97394. EPSS is 0.43%. Act only if a listed version of kin-openapi is a Go is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (kin-openapi is a Go).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
High7.5
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.43%
Remediation
Version ranges on file
Affected products
Go github.com/getkin/kin-openapi · go github.com/getkin/kin-openapi · golang github.com

### Summary A nil-pointer dereference in lets any unauthenticated client crash a request handler with a single HTTP request against an OpenAPI **3.1** operation that declares **without** . OpenAPI 3.1 (JSON Schema 2020-12) permits omitting , and accepts such schemas with . Request/response decoders then dereference with no nil check. The panic is **deterministic (100%)** on every request to the affected operation. There is no in ; under handlers without per-request recover the process can exit. ### Details **Spec-validation asymmetry.** OpenAPI 3.0 rejects array schemas that omit ([ ](https://github.com/getkin/kin-openapi/blob/master/openapi3/schema.go) around the / branch). For OpenAPI 3.1, enables , so that check is skipped and remains nil after a clean . **Vulnerable decoder.** The primary request-side crash is in [ ](https://github.com/getkin/kin-openapi/blob/master/openapi3filter/req_resp_decoder.go) (still present on this checkout at L1421): This runs during schema inspection **before** form values are parsed. Any non-empty body for the operation reaches the dereference (an empty body is rejected earlier when is true, and never enters the decoder). The same nil also crashes: | Path | Location | Trigger | |---|---|---| | | ~1564 → 1579 | part named like the array property | | → | ~1129 / 1151 | Array-typed **response headers** via , and path/cookie array params | / call / directly with no recover, so the panic escapes the library into the application. **Recommended fix.** Guard nil and return a structured decode/validation error, e.g.: Apply equivalent guards in and before calling . ### PoC Verified against revision , Go 1.25, . **1. Spec** — OpenAPI 3.1 operation with urlencoded body and property without : **2. E2E program** — server using the same public entrypoint ( → ) real middleware uses. Save as in a module that depends on at a vulnerable revision, then : **3. Observed output** ( ): Then: Server log: Stack pins the fault to at , called from → → . **Attac

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • Go github.com/getkin/kin-openapi0.136.0 → 0.143.0
  • go github.com/getkin/kin-openapi>= 0.136.0, < 0.143.0
  • golang github.comversion unspecified

How to fix CVE-2026-97394

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-97394. EPSS is 0.43%. Act only if a listed version of kin-openapi is a Go is installed.

Which versions are affected?

Compare what you have installed with 0.136.0 → 0.143.0, >= 0.136.0, < 0.143.0. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-248; CWE-476: NULL Pointer Dereference. EPSS 0.43%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 15, 2026 · NIST NVD

    Detected

    kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.143.0, openapi3filter accepts OpenAPI 3.1 array schemas without an items keyword and then dereferences the nil Schema.Items value while decoding application/x-www-form-urlencoded or multipart/form-data request bodies, response headers, and other array parameter surfaces. A remote unauthenticated client can reach an affect

  2. Oct 15, 2026 · NIST NVD

    Updated

    kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.143.0, openapi3filter accepts OpenAPI 3.1 array schemas without an items keyword and then dereferences the nil Schema.Items value while decoding application/x-www-form-urlencoded or multipart/form-data request bodies, response headers, and other array parameter surfaces. A remote unauthenticated client can reach an affect

  3. Oct 15, 2026 · GitHub Advisory Database

    Fix available

    github.com/getkin/kin-openapi fixed in 0.143.0

  4. Oct 15, 2026 · GitHub Advisory Database

    Fix available

    github.com/getkin/kin-openapi fixed in 0.143.0

  5. Oct 15, 2026 · GitHub Advisory Database

    Updated

    ### Summary A nil-pointer dereference in lets any unauthenticated client crash a request handler with a single HTTP request against an OpenAPI **3.1** operation that declares **without** . OpenAPI 3.1 (JSON Schema 2020-12) permits omitting , and accepts such schemas with . Request/response decoders then dereference with no nil check. The panic is **deterministic (100%)** on every request to the af

Sources

  • CVE.orgVulnerability recordCVE-2026-97394

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-97394

    30-day exploitation probability 0.4%

    first.org
  • GitHub Advisory DatabasePackage advisoryGHSA-p6wj-qrr4-pgh5

    kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing items

    github.com
  • GitLab Advisory DatabasePackage advisoryCVE-2026-97394

    A nil-pointer dereference in openapi3filter lets any unauthenticated client crash a request handler with a single HTTP request against an OpenAPI 3.1 operation that declares type: array without items. OpenAPI 3.1 (JSON Schema 2020-12) permits omitting items, and doc.Validate() accepts such schemas with Schema.Items == nil. Request/response decoders then dereference Items with no nil check. The pan

    advisories.gitlab.com
  • NIST NVDVulnerability recordCVE-2026-97394

    kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.143.0, openapi3filter accepts OpenAPI 3.1 array schemas without an items keyword and then dereferences the nil Schema.Items value while decoding application/x-www-form-urlencoded or multipart/form-data r

    nvd.nist.gov
  • OpenSSF OSV / OSV ScannerPackage advisoryGHSA-p6wj-qrr4-pgh5

    kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing items

    osv.dev

References

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.