CVE-2026-100354 Details
Description
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.149.0, runtime request, response, and direct schema validation lacks cycle detection when an allOf, anyOf, or oneOf chain refers back to an ancestor schema, even though loading and document validation accept the circular reference. A request or response that reaches the affected schema causes unbounded recursion in Schema.visitJSON or openapi3filter.decodeValue and exhausts the Go goroutine stack. The resulting fatal stack overflow cannot be caught with recover and terminates the entire process, including unrelated requests. This issue is fixed in version 0.149.0.
A denial-of-service vulnerability has been identified in kin-openapi versions prior to 0.149.0. The issue arises during runtime validation of request and response schemas that contain circular references in their combinator chains (allOf, anyOf, oneOf). While the specification loader and validator can handle such circular references safely, the runtime validators lack this protection. As a result, the recursion through the circular schema references becomes unbounded, causing a fatal stack overflow that terminates the entire process, including unrelated requests. This vulnerability is particularly concerning for applications that load OpenAPI specifications from untrusted sources or serve fixed, trusted specifications that happen to contain circular references.
Users can upgrade to kin-openapi version 0.149.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 15, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/getkin/kin-openapi/security/advisories/GHSA-g8cf-rcjf-c8cf | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/getkin/kin-openapi/commit/9245cef66c840e27a08409a8a5cd0ee930c5bcff | [email protected] | Source CodeVendor |
| https://github.com/getkin/kin-openapi/releases/tag/v0.149.0 | [email protected] | Release NotesVendor |
| https://github.com/getkin/kin-openapi/security/advisories/GHSA-g8cf-rcjf-c8cf | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-674 | Uncontrolled Recursion | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| kin-openapi | 0.144.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 15, 2026 | New CVE Received | [email protected] |