CVE-2026-100350

Name of the Vulnerable Software and Affected Versions kin-openapi versions 0.145.0 through 0.145.x

Description An unauthenticated remote client can cause a denial of service via uncontrolled CPU consumption. The issue occurs when openapi3filter decodes deepObject style query parameters; it repeatedly calls regexp.MustCompile for the same parameter-name regular expression inside a loop for every query key provided in the request. Because the number of query keys is attacker-controlled and unbounded, a request containing many unrelated query keys forces a proportional number of recompilations, saturating CPU cores and increasing memory allocations. This affects any operation using the ValidateRequest function with at least one in: query and style: deepObject parameter.

Recommendations Update kin-openapi to version 0.146.0. As a temporary mitigation, implement a limit on request/URL size or the maximum number of query keys at a reverse proxy or middleware level to bound the number of loop iterations.