CVE-2026-97394 kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing items
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-97394?
CVE-2026-97394 is a high-severity vulnerability in getkin kin-openapi, published on 15 Oct 2026.
Official description
kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.143.0, openapi3filter accepts OpenAPI 3.1 array schemas without an items keyword and then dereferences the nil Schema.Items value while decoding application/x-www-form-urlencoded or multipart/form-data request bodies, response headers, and other array parameter surfaces. A remote unauthenticated client can reach an affected operation with a nonempty request or matching response and deterministically trigger a nil-pointer panic during ValidateRequest or ValidateResponse. OpenAPI 3.0 documents are not affected because document validation rejects arrays without items, and JSON request bodies use a different decoder path. This issue is fixed in version 0.143.0.
Which versions are affected by CVE-2026-97394?
2 open source packages ship an affected version, including github.com/getkin/kin-openapi.
| Package | Affected | Fixed in |
|---|---|---|
github.com/getkin/kin-openapi Go | From 0.136.0 | 0.143.0 |
github.com/getkin/kin-openapi Go | From 0.136.0 | 0.143.0 |
How do I fix CVE-2026-97394?
Upgrade github.com/getkin/kin-openapi to 0.143.0 or later.
Is CVE-2026-97394 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-97394 exists.
Sources
Also known as GHSA-p6wj-qrr4-pgh5, MINI-2xg6-xx4c-8mh4, MINI-35gp-vm5m-g56h, MINI-3j9p-g58p-f2rp, MINI-58mq-64mv-hxp5, MINI-78xv-jf98-jfgc and 8 more.