CVE-2026-97394

Name of the Vulnerable Software and Affected Versions kin-openapi versions 0.136.0 through 0.143.0

Description A nil-pointer dereference in the openapi3filter component allows an unauthenticated remote client to cause a denial of service. This occurs when the software processes OpenAPI 3.1 array schemas that omit the items keyword. When decoding application/x-www-form-urlencoded or multipart/form-data request bodies, response headers, or other array parameter surfaces, the system dereferences a nil Schema.Items value, leading to a deterministic panic during ValidateRequest() or ValidateResponse() functions. This issue is specific to OpenAPI 3.1 as OpenAPI 3.0 documents are rejected during validation if items are missing, and JSON request bodies utilize a different decoding path.

Recommendations Update kin-openapi to version 0.143.0. As a temporary mitigation, avoid using OpenAPI 3.1 schemas that define type: array without the items keyword in urlencoded or multipart body properties and response headers.