CVE-2026-100353 kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter
An unauthenticated remote attacker can cause a denial of service via a nil-pointer panic in kin-openapi by sending crafted array parameters or bodies.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-100353?
CVE-2026-100353 is a high-severity vulnerability in getkin kin-openapi, published on 15 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.149.0, three openapi3filter decoder paths that were missed by the fix for GHSA-p6wj-qrr4-pgh5 lack a nil-items guard for legal OpenAPI 3.1 array schemas. An unauthenticated remote client can trigger a deterministic nil-pointer panic through an array query parameter, a deepObject query parameter containing an array property, or an application/x-www-form-urlencoded request body whose array property appears inside an allOf, anyOf, or oneOf subschema. The query and composed-body paths reach urlValuesDecoder.parseArray, while the deepObject path reaches buildResObj, and all pass a nil items schema into code that dereferences it. This issue is fixed in version 0.149.0.
Weakness: CWE-476
Which versions are affected by CVE-2026-100353?
2 open source packages ship an affected version, including github.com/getkin/kin-openapi.
| Package | Affected | Fixed in |
|---|---|---|
github.com/getkin/kin-openapi Go | From 0.136.0 | 0.149.0 |
github.com/getkin/kin-openapi Go | From 0.136.0 | 0.149.0 |
How do I fix CVE-2026-100353?
Upgrade github.com/getkin/kin-openapi to 0.149.0 or later.
Is CVE-2026-100353 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-100353 exists.
Sources
Also known as CLEANSTART-2026-KH25643, ECHO-3b34-ae40-bbcf, GHSA-vrcc-3ch7-hppw, MINI-2wqf-8h3q-m5cx, MINI-5mjx-m6cp-g8v4, MINI-73h7-74q6-pxwv and 12 more.