CVE-2026-100350: kin-openapi deepObject query decoding repeatedly compiles an invariant regular expression
kin-openapi is a Go project for handling OpenAPI files. From 0.145.0 until 0.146.0, openapi3filter repeatedly calls regexp.MustCompile for the same parameter-name regular expression inside the per-query-key loop in urlValuesDecoder.DecodeObject used to decode a deepObject query parameter. An unauthenticated remote client can send an affected endpoint a request containing many unrelated query keys, causing ValidateRequest to perform work and allocations proportional to the attacker-controlled key count for every deepObject parameter. The expression itself is fixed and this is not regular expression denial of service; the resource consumption comes from loop-invariant recompilation. This issue is fixed in version 0.146.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
kin-openapito a version that resolves this vulnerability.Fixed in 0.146.0
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using getkin/kin-openapi versions from 0.145.0 up to, but not including, 0.146.0 are affected when they validate requests for endpoints that use deepObject query parameters. The affected processing occurs in openapi3filter during ValidateRequest.
What does an attacker need to do to trigger the resource consumption?
An unauthenticated remote client only needs to send a request to an affected endpoint with many unrelated query-string keys. For each deepObject parameter, request validation performs work and allocations proportional to the attacker-controlled number of keys.
Is this a regular-expression denial-of-service vulnerability?
No. The regular expression is fixed; the issue is repeated compilation of that invariant expression inside a loop, rather than expensive matching behavior.
What is the remediation?
Upgrade getkin/kin-openapi to version 0.146.0, which fixes the repeated regular-expression compilation.