{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/kin-openapi--0.136.0--0.149.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:kin-openapi:kin-openapi:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-100353"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["kin-openapi (\u003e= 0.136.0, \u003c 0.149.0)"],"_cs_severities":["low"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["kin-openapi"],"content_html":"\u003cp\u003eThe kin-openapi library contains an unpatched denial-of-service vulnerability (CVE-2026-100353) stemming from an incomplete fix for a previously identified nil-pointer dereference. Under OpenAPI 3.1 and JSON Schema 2020-12, it is syntactically valid to define an array schema that omits the 'items' keyword. However, the \u003ccode\u003eopenapi3filter\u003c/code\u003e component fails to properly validate the presence of the 'items' property before dereferencing it during the decoding process.\u003c/p\u003e\n\u003cp\u003eThe vulnerability manifests in three distinct paths: query parameters with array types, 'deepObject' query parameters containing array properties, and URL-encoded request bodies where arrays are nested within 'allOf', 'anyOf', or 'oneOf' constructs. An unauthenticated attacker can exploit this by crafting a request that matches these specific schema conditions. Depending on the application's runtime architecture, this causes either the immediate termination of the request-handling goroutine or a full process crash, leading to a denial-of-service condition for the affected service. The vulnerability affects all versions of kin-openapi from 0.136.0 up to, but not including, 0.149.0.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe impact of this vulnerability ranges from per-request connection drops to full-process crashes. In standard Go \u003ccode\u003enet/http\u003c/code\u003e implementations, the panic is recovered per-connection, resulting in service degradation. In environments utilizing 'fasthttp', 'connect' adapters, or custom application-managed goroutines, a single malformed request can result in an unrecoverable process crash and total service unavailability. This vulnerability is applicable to any microservice or API gateway utilizing kin-openapi for request validation.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized actions for detection and remediation:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the \u003ccode\u003egithub.com/getkin/kin-openapi\u003c/code\u003e dependency to version 0.149.0 or later immediately to incorporate the required nil-pointer checks in \u003ccode\u003eurlValuesDecoder.parseArray\u003c/code\u003e and \u003ccode\u003ebuildResObj\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003ePerform a code audit of Go-based API services to identify ingestion points using \u003ccode\u003eopenapi3filter.ValidateRequest\u003c/code\u003e where the application does not have a global panic recovery mechanism.\u003c/li\u003e\n\u003cli\u003eImplement global panic recovery middleware in all Go HTTP servers utilizing kin-openapi to mitigate the risk of full-process termination until patches can be deployed.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-15T22:23:45Z","date_published":"2026-10-15T22:23:45Z","id":"https://feed.craftedsignal.io/briefs/2026-10-kin-openapi-nil-panic/","summary":"An incomplete fix for an OpenAPI 3.1 validation flaw allows unauthenticated attackers to trigger process-crashing nil-pointer dereferences in kin-openapi by supplying array schemas without an 'items' keyword.","title":"Denial of Service via Nil-Pointer Dereference in kin-openapi","url":"https://feed.craftedsignal.io/briefs/2026-10-kin-openapi-nil-panic/"}],"language":"en","title":"CraftedSignal Threat Feed - Kin-Openapi (\u003e= 0.136.0, \u003c 0.149.0)","version":"https://jsonfeed.org/version/1.1"}