CVE-2026-100347

Name of the Vulnerable Software and Affected Versions kin-openapi versions prior to 0.145.0

Description An unauthenticated remote client can trigger a denial of service by sending an unsupported or non-canonical HTTP method (such as PROPFIND or lowercase get) to an existing static path. The openapi3filter.ValidationHandler uses a legacy router that fails to canonicalize the request method. When a non-standard method is used for a static path, the GetOperation() function in the openapi3.PathItem component triggers a panic before authentication occurs. While the Go net/http server recovers from the panic per connection, repeated requests cause connection aborts and unbounded growth of stack-trace logs.

Recommendations Update kin-openapi to version 0.145.0.