CVE-2026-100350 Details

A denial-of-service vulnerability has been identified in Kin-OpenAPI versions 0.145.0 prior to 0.146.0. The issue arises in the openapi3filter component, where a loop-invariant regular expression is repeatedly recompiled for each query key in deepObject-style parameters. This flaw allows an unauthenticated remote client to send requests with a high number of unrelated query keys, causing excessive CPU usage and memory allocations during request validation. The vulnerability is not related to regular expression denial-of-service, as the pattern matches in linear time; instead, it stems from the unnecessary recompilation of the regular expression, which can be exploited to degrade or disrupt service.

Users can upgrade to Kin-OpenAPI version 0.146.0 or later, where this vulnerability has been fixed. Alternatively, as a temporary measure, affected endpoints can be fronted with a reverse proxy or middleware that limits request size or the number of query keys, thereby reducing the potential impact of the vulnerability.