CVE-2026-100354: kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crash
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.149.0, runtime request, response, and direct schema validation lacks cycle detection when an allOf, anyOf, or oneOf chain refers back to an ancestor schema, even though loading and document validation accept the circular reference. A request or response that reaches the affected schema causes unbounded recursion in Schema.visitJSON or openapi3filter.decodeValue and exhausts the Go goroutine stack. The resulting fatal stack overflow cannot be caught with recover and terminates the entire process, including unrelated requests. This issue is fixed in version 0.149.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
kin-openapito a version that resolves this vulnerability.Fixed in 0.149.0
Event History
Frequently Asked Questions
Which deployments are exposed to a remote crash?
Deployments using kin-openapi before 0.149.0 are exposed if they perform runtime request or response validation on schemas containing a circular allOf, anyOf, or oneOf chain. A request or response that reaches the affected schema can terminate the entire process, including unrelated requests.
What does an attacker need to exploit this issue?
An attacker does not need privileges or user interaction. They need to cause validation of a request or response against an affected circular schema chain.
Are circular schemas rejected before runtime?
No. Loading and document validation accept the circular reference; the failure occurs during runtime request, response, or direct schema validation.
What should be done if an immediate upgrade is not possible?
Avoid runtime validation of schemas with circular allOf, anyOf, or oneOf chains, and remove or redesign those circular schema relationships where possible. The provided data identifies version 0.149.0 as the fix.