Denial of Service via Nil-Pointer Dereference in kin-openapi

The kin-openapi library contains an unpatched denial-of-service vulnerability (CVE-2026-100353) stemming from an incomplete fix for a previously identified nil-pointer dereference. Under OpenAPI 3.1 and JSON Schema 2020-12, it is syntactically valid to define an array schema that omits the 'items' keyword. However, the openapi3filter component fails to properly validate the presence of the 'items' property before dereferencing it during the decoding process.

The vulnerability manifests in three distinct paths: query parameters with array types, 'deepObject' query parameters containing array properties, and URL-encoded request bodies where arrays are nested within 'allOf', 'anyOf', or 'oneOf' constructs. An unauthenticated attacker can exploit this by crafting a request that matches these specific schema conditions. Depending on the application's runtime architecture, this causes either the immediate termination of the request-handling goroutine or a full process crash, leading to a denial-of-service condition for the affected service. The vulnerability affects all versions of kin-openapi from 0.136.0 up to, but not including, 0.149.0.

Impact

The impact of this vulnerability ranges from per-request connection drops to full-process crashes. In standard Go net/http implementations, the panic is recovered per-connection, resulting in service degradation. In environments utilizing 'fasthttp', 'connect' adapters, or custom application-managed goroutines, a single malformed request can result in an unrecoverable process crash and total service unavailability. This vulnerability is applicable to any microservice or API gateway utilizing kin-openapi for request validation.

Recommendation

Prioritized actions for detection and remediation:

• Upgrade the github.com/getkin/kin-openapi dependency to version 0.149.0 or later immediately to incorporate the required nil-pointer checks in urlValuesDecoder.parseArray and buildResObj.
• Perform a code audit of Go-based API services to identify ingestion points using openapi3filter.ValidateRequest where the application does not have a global panic recovery mechanism.
• Implement global panic recovery middleware in all Go HTTP servers utilizing kin-openapi to mitigate the risk of full-process termination until patches can be deployed.