CVE-2026-100353: kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter
kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.149.0, three openapi3filter decoder paths that were missed by the fix for GHSA-p6wj-qrr4-pgh5 lack a nil-items guard for legal OpenAPI 3.1 array schemas. An unauthenticated remote client can trigger a deterministic nil-pointer panic through an array query parameter, a deepObject query parameter containing an array property, or an application/x-www-form-urlencoded request body whose array property appears inside an allOf, anyOf, or oneOf subschema. The query and composed-body paths reach urlValuesDecoder.parseArray, while the deepObject path reaches buildResObj, and all pass a nil items schema into code that dereferences it. This issue is fixed in version 0.149.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
kin-openapito a version that resolves this vulnerability.Fixed in 0.149.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using kin-openapi versions from 0.136.0 through before 0.149.0 are affected when they process requests against legal OpenAPI 3.1 array schemas with missing items definitions on the affected decoder paths.
Does exploitation require authentication or special user interaction?
No. An unauthenticated remote client can trigger the panic, and no user interaction is required.
What request patterns can trigger the denial of service?
The panic can be triggered through an array query parameter, a deepObject query parameter with an array property, or an application/x-www-form-urlencoded body where an array property is inside an allOf, anyOf, or oneOf subschema.
What is the available remediation?
Upgrade kin-openapi to version 0.149.0, which fixes the missing nil-items guards.