CVE-2026-100352 in kin-openapi
Summary
by MITRE • 10/15/2026
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.148.0, the OpenAPI 3.1 validation path passes YAML NaN and infinity numeric values to santhosh-tekuri/jsonschema v6.0.2 without applying kin-openapi's existing finite-number guards. A remote unauthenticated client can send an application/yaml or application/x-yaml request body containing .nan, .inf, or -.inf to an operation with a numeric constraint, causing the dependency to create and dereference a nil big.Rat during ValidateRequest. Standard net/http servers recover the panic per connection, while other hosts or application goroutines may terminate the process. This issue is fixed in version 0.148.0.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/15/2026
The kin-openapi library serves as a critical component for Go-based applications that need to parse and validate OpenAPI specifications, ensuring that incoming requests conform to defined API schemas. A significant security vulnerability exists within the validation logic prior to version 0.148.0, specifically concerning how numeric constraints are handled during the processing of YAML-formatted request bodies. The core flaw lies in a failure to apply existing finite-number guards before passing values to the underlying schema validation dependency, santhosh-tekuri/jsonschema v6.0.2. This oversight allows maliciously crafted input containing special IEEE 754 floating-point representations, such as NaN (Not a Number), positive infinity (.inf or +inf), and negative infinity (-.inf or -inf), to bypass initial validation checks that would normally reject non-finite numeric values.
When an unauthenticated remote client submits an application/yaml or application/x-yaml request body containing these specific malformed numeric literals for an operation defined with a numeric constraint, the kin-openapi library forwards this input directly to the jsonschema validator without sanitization. The santhosh-tekuri/jsonschema library attempts to process these values and subsequently invokes internal functions that rely on big.Rat structures for precise arithmetic operations. However, due to the presence of NaN or infinity values which do not have a valid representation in rational numbers, this processing leads to the creation and subsequent dereferencing of a nil pointer. This results in a runtime panic within the ValidateRequest function, disrupting the normal execution flow of the application.
The operational impact of this vulnerability is primarily centered on availability, manifesting as a denial-of-service condition through process termination or resource exhaustion depending on the hosting environment. In standard net/http server configurations, Go's default behavior often recovers from panics on a per-connection basis, which may allow the server to continue serving other requests but still causes the failure of the specific malicious request and potentially consumes excessive resources if repeated rapidly. However, in environments where panic recovery is not implemented at the application level or when running within goroutines that do not have dedicated panic handlers, this vulnerability can lead to the complete termination of the entire process. This makes it a severe threat for long-running services that rely on stability and continuous availability, as an attacker could easily crash the service by sending a single carefully crafted HTTP request with YAML-encoded NaN or infinity values.
This issue is classified under CWE-20 Improper Input Validation, as the application fails to validate user-supplied input against expected constraints before processing it. Furthermore, from a tactical perspective in cyber defense frameworks like MITRE ATT&CK, this vulnerability aligns with techniques related to Denial of Service via resource exhaustion or process crash, specifically leveraging software vulnerabilities for availability impact. The attack vector is remote and unauthenticated, requiring only network access to the target API endpoint. To mitigate this risk, organizations must upgrade kin-openapi to version 0.148.0 or later, where the developers have implemented proper guards to filter out non-finite numeric values before they reach the schema validation layer. Additionally, implementing robust panic recovery mechanisms in Go applications can provide an additional layer of defense against similar vulnerabilities that might arise from other dependencies or future updates.