Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-97394— kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing items

Quick assessment

Affected
getkin kin-openapi
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

kin-openapi 是一个用于处理 OpenAPI 文件的 Go 语言项目。在版本 0.136.0 到 0.143.0 之间，openapi3filter 组件在解析符合 OpenAPI 3.1 规范的数组类型 schema 时，若该 schema 缺少 关键字，则会在解码 或 类型的请求体、响应头以及其他数组类型参数时，解引用为 nil 的 字段，从而导致空指针异常。远程未认证的客户端可通过向受影响的操作发送非空请求或匹配的响应，确定性地触发 或 过程中的空指针恐慌（panic）。由于文档校验会拒绝缺少 关键

CVSS 7.5 · High

Affected Version Matrix 1

VendorProduct Version RangeStatus
getkin kin-openapi >= 0.136.0, < 0.143.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-97394

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing items
Source: CVE Program / CVE List V5
Vulnerability Description
kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.143.0, openapi3filter accepts OpenAPI 3.1 array schemas without an items keyword and then dereferences the nil Schema.Items value while decoding application/x-www-form-urlencoded or multipart/form-data request bodies, response headers, and other array parameter surfaces. A remote unauthenticated client can reach an affected operation with a nonempty request or matching response and deterministically trigger a nil-pointer panic during ValidateRequest or ValidateResponse. OpenAPI 3.0 documents are not affected because document validation rejects arrays without items, and JSON request bodies use a different decoder path. This issue is fixed in version 0.143.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未捕获的异常
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
getkin kin-openapi >= 0.136.0, < 0.143.0 -

II. Public POCs for CVE-2026-97394

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-97394

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-97394 (1)

Vendor Advisories for CVE-2026-97394 (1)

Other References for CVE-2026-97394 (1)

Same Patch Batch · getkin · 2026-10-15 · 9 CVEs total

CVE-2026-100349 8.2 HIGH kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header dec
CVE-2026-100352 7.5 HIGH kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation P
CVE-2026-100353 7.5 HIGH kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths
CVE-2026-100354 7.5 HIGH kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Pro
CVE-2026-100351 7.4 HIGH kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation conf
CVE-2026-100348 5.3 MEDIUM kin-openapi spec loader panics on a self-referential additionalProperties $ref (nil-pointe
CVE-2026-100350 5.3 MEDIUM kin-openapi deepObject query decoding repeatedly compiles an invariant regular expression
CVE-2026-100347 5.3 MEDIUM kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical

IV. Related Vulnerabilities

Same product: kin-openapi
Same vendor: getkin
Same weakness: CWE-248

V. Comments for CVE-2026-97394

No comments yet

Leave a comment