CVE-2026-100348 kin-openapi spec loader panics on a self-referential additionalProperties $ref (nil-pointer DoS)
An attacker can cause a denial of service by providing a malicious OpenAPI document with a self-referential additionalProperties reference, crashing the application using kin-openapi.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-100348?
CVE-2026-100348 is a medium-severity vulnerability in getkin kin-openapi, published on 15 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3.Loader can dereference a nil SchemaRef.Value while resolving a self-referential additionalProperties JSON Reference such as a schema that points to its own additionalProperties member. Loading an attacker-controlled OpenAPI document through LoadFromData, LoadFromFile, or LoadFromURI reaches resolveComponent before document validation and can panic the loading process. Resolved additionalProperties schemas and ordinary recursive schemas do not take the vulnerable nil-value path. This issue is fixed in version 0.145.0.
Weakness: CWE-476
Which versions are affected by CVE-2026-100348?
2 open source packages ship an affected version, including github.com/getkin/kin-openapi.
| Package | Affected | Fixed in |
|---|---|---|
github.com/getkin/kin-openapi Go | All versions | 0.145.0 |
github.com/getkin/kin-openapi Go | All versions | 0.145.0 |
How do I fix CVE-2026-100348?
Upgrade github.com/getkin/kin-openapi to 0.145.0 or later.
Is CVE-2026-100348 being exploited?
There is no known exploitation of CVE-2026-100348 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-IX43847, DEBIAN-CVE-2026-100348, ECHO-9e48-c71d-7876, GHSA-mh7x-f8wq-4jhx, MINI-2342-349w-x2vw, MINI-23wg-pgj4-g8jg and 31 more.