CVE-2026-100348

Name of the Vulnerable Software and Affected Versions kin-openapi versions prior to 0.145.0

Description Loading an attacker-controlled OpenAPI document through LoadFromData, LoadFromFile, or LoadFromURI can cause the loading process to panic. This occurs because the openapi3.Loader can dereference a nil SchemaRef.Value when resolving a self-referential additionalProperties JSON Reference, such as a schema that points to its own additionalProperties member. The issue is triggered within the resolveComponent() function during the reference resolution process, which happens before document validation.

Recommendations Update kin-openapi to version 0.145.0 or later.