PT-2026-115009 · Go+2 · Github.Com/Getkin/Kin-Openapi+1

CVE-2026-100353

·

Published

2026-10-15

·

Updated

2026-10-15

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions kin-openapi versions 0.136.0 through 0.148.0
Description An unauthenticated remote client can trigger a deterministic nil-pointer panic during request validation. This occurs when an OpenAPI 3.1 array schema omits the items keyword, which is legal under JSON Schema 2020-12, but is not properly handled by the decoder. The issue is triggered through three paths:
  1. An array query parameter.
  2. A deepObject query parameter containing an array property.
  3. An application/x-www-form-urlencoded request body where an array property is located inside an allOf, anyOf, or oneOf sub-schema.
Technically, the urlValuesDecoder.parseArray() method and the buildResObj() function fail to implement a nil-items guard, leading to a nil-pointer dereference in parseValue(). Depending on the deployment, this can result in a per-request denial of service or a full-process crash.
Recommendations Update kin-openapi to version 0.149.0.

Exploit

Fix

NULL Pointer Dereference

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2026-100353
GHSA-VRCC-3CH7-HPPW

Affected Products

Github.Com/Getkin/Kin-Openapi
Kin-Openapi