CVE-2026-100353— kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter
Quick assessment
Affected
getkin kin-openapi
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
kin-openapi 是一个用于处理 OpenAPI 文件的 Go 语言项目。在版本 0.136.0 到 0.149.0 之间，存在三个因 GHSA-p6wj-qrr4-pgh5 修复遗漏而未添加 nil-items 安全校验的 openapi3filter 解码路径，这些路径在处理符合规范的 OpenAPI 3.1 数组 schema 时会出现问题。未认证的远程攻击者可以通过以下任一方式触发确定性的空指针 panic： 数组类型的查询参数（array query parameter）； 包含数组属性的 deep
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| getkin | kin-openapi | >= 0.136.0, < 0.149.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-100353
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter
Source: CVE Program / CVE List V5
Vulnerability Description
kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.149.0, three openapi3filter decoder paths that were missed by the fix for GHSA-p6wj-qrr4-pgh5 lack a nil-items guard for legal OpenAPI 3.1 array schemas. An unauthenticated remote client can trigger a deterministic nil-pointer panic through an array query parameter, a deepObject query parameter containing an array property, or an application/x-www-form-urlencoded request body whose array property appears inside an allOf, anyOf, or oneOf subschema. The query and composed-body paths reach urlValuesDecoder.parseArray, while the deepObject path reaches buildResObj, and all pass a nil items schema into code that dereferences it. This issue is fixed in version 0.149.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
空指针解引用
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| getkin | kin-openapi | >= 0.136.0, < 0.149.0 | - |
|
II. Public POCs for CVE-2026-100353
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-100353
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-100353 (1)
-
Merge commit from fork · getkin/kin-openapi@9814d1f · GitHub x_refsource_MISC
Vendor Advisories for CVE-2026-100353 (1)
Vendor Pages for CVE-2026-100353 (1)
-
Release v0.149.0 · getkin/kin-openapi · GitHub x_refsource_MISC
Same Patch Batch · getkin · 2026-10-15 · 9 CVEs total
| CVE-2026-100349 | 8.2 HIGH | kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header dec |
| CVE-2026-97394 | 7.5 HIGH | kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas |
| CVE-2026-100352 | 7.5 HIGH | kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation P |
| CVE-2026-100354 | 7.5 HIGH | kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Pro |
| CVE-2026-100351 | 7.4 HIGH | kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation conf |
| CVE-2026-100348 | 5.3 MEDIUM | kin-openapi spec loader panics on a self-referential additionalProperties $ref (nil-pointe |
| CVE-2026-100350 | 5.3 MEDIUM | kin-openapi deepObject query decoding repeatedly compiles an invariant regular expression |
| CVE-2026-100347 | 5.3 MEDIUM | kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical |
IV. Related Vulnerabilities
Same product: kin-openapi
-
CVE-2026-100354
kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/ -
CVE-2026-100352
kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and -
CVE-2026-100351
kin-openapi: ValidationHandler security-requirement bypass v -
CVE-2026-100349
kin-openapi openapi3filter: nil-pointer panic in ValidateRes -
CVE-2026-100350
kin-openapi deepObject query decoding repeatedly compiles an
Same vendor: getkin
-
CVE-2026-100354
kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/ -
CVE-2026-100352
kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and -
CVE-2026-100351
kin-openapi: ValidationHandler security-requirement bypass v -
CVE-2026-100349
kin-openapi openapi3filter: nil-pointer panic in ValidateRes -
CVE-2026-100350
kin-openapi deepObject query decoding repeatedly compiles an
Same weakness: CWE-476
-
CVE-2026-111144
libansilove 1.3.0 through 1.4.2 NULL Pointer Dereference via -
CVE-2026-111129
Assimp through 6.0.5 NULL Pointer Dereference via Ogre Anima -
CVE-2026-111128
Assimp through 6.0.5 NULL Pointer Dereference via Ogre Impor -
CVE-2026-100349
kin-openapi openapi3filter: nil-pointer panic in ValidateRes -
CVE-2026-100348
kin-openapi spec loader panics on a self-referential additio
V. Comments for CVE-2026-100353
No comments yet