CVE-2026-100354

Name of the Vulnerable Software and Affected Versions kin-openapi versions prior to 0.149.0

Description Runtime request, response, and direct schema validation lack cycle detection when an allOf, anyOf, or oneOf chain refers back to an ancestor schema. While loading and document validation accept circular references, processing a request or response that reaches such a schema causes unbounded recursion. This leads to a fatal stack overflow that cannot be caught by recovery mechanisms, resulting in the termination of the entire process and a complete denial of service for all users.

Technical details include two primary recursion sites:

Recommendations Update kin-openapi to version 0.149.0. As a temporary mitigation, avoid using the allOf, anyOf, or oneOf combinators in schemas that may contain circular references.