CVE-2026-100352 Details

A denial-of-service vulnerability has been identified in kin-openapi versions prior to 0.148.0. The issue arises in the OpenAPI 3.1 validation path, where YAML NaN and infinity numeric values are processed without proper guards against finite-number constraints. This flaw allows a remote, unauthenticated client to send a request with application/yaml or application/x-yaml content, including .nan, .inf, or -.inf values, to an operation with numeric constraints. The absence of validation leads to a panic caused by dereferencing a nil big.Rat value during request validation. While standard net/http servers can recover from this panic on a per-connection basis, other hosting environments or application goroutines may experience a complete process termination.

Users can upgrade to kin-openapi version 0.148.0 or later, where this vulnerability has been fixed.