CVE-2026-100352

Name of the Vulnerable Software and Affected Versions kin-openapi versions prior to 0.148.0

Description An issue exists where the OpenAPI 3.1 validation path fails to apply finite-number guards when passing YAML NaN and infinity numeric values to the santhosh-tekuri/jsonschema dependency. A remote unauthenticated client can send a request body with application/yaml or application/x-yaml content types containing .nan, .inf, or -.inf to an operation with a numeric constraint. This causes the dependency to create and dereference a nil big.Rat during the ValidateRequest() function, leading to a panic. While standard net/http servers recover from this panic per connection, other hosts or application goroutines may terminate the process.

Recommendations Update to version 0.148.0.