CVE-2026-100354 in kin-openapi
Summary
by MITRE • 10/15/2026
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.149.0, runtime request, response, and direct schema validation lacks cycle detection when an allOf, anyOf, or oneOf chain refers back to an ancestor schema, even though loading and document validation accept the circular reference. A request or response that reaches the affected schema causes unbounded recursion in Schema.visitJSON or openapi3filter.decodeValue and exhausts the Go goroutine stack. The resulting fatal stack overflow cannot be caught with recover and terminates the entire process, including unrelated requests. This issue is fixed in version 0.149.0.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/15/2026
The kin-openapi library serves as a critical component for many Go-based applications that need to parse, validate, and handle OpenAPI specifications. In versions prior to 0.149.0, the runtime validation logic contains a significant architectural flaw regarding how it handles circular references within complex schema definitions. Specifically, while the document loading phase correctly identifies and accepts circular references in allOf, anyOf, or oneOf chains, the subsequent runtime validation phases fail to implement cycle detection mechanisms when traversing these schemas against actual request or response payloads. This discrepancy between static analysis during load time and dynamic processing at runtime creates a dangerous gap in security controls that can be exploited by malicious actors.
The technical root of this vulnerability lies in the recursive traversal algorithms used within Schema.visitJSON and openapi3filter.decodeValue functions. When an OpenAPI schema defines a structure where a nested object references its own parent type through oneOf, anyOf, or allOf constructs, the validation engine attempts to recursively validate each branch of the logical union without tracking visited nodes. Because there is no mechanism to detect that a particular schema node has already been processed in the current call stack, the function enters an infinite loop. This unbounded recursion rapidly consumes memory and eventually triggers a fatal stack overflow error within the Go runtime environment.
The operational impact of this vulnerability is severe due to its potential for causing Denial of Service conditions with minimal effort from an attacker. Since the resulting panic cannot be caught using standard Go recover mechanisms, it causes immediate termination of the entire application process rather than just failing the specific request that triggered the issue. This means a single maliciously crafted HTTP request containing a deeply nested or circular JSON payload can crash the server entirely, affecting all other concurrent users and services running on the same instance. The lack of isolation between individual requests amplifies the blast radius, turning what might otherwise be a simple validation error into a complete service outage.
From an industry standards perspective, this vulnerability aligns with CWE-674, which describes Uncontrolled Recursion in functions that do not limit their depth of recursion. It also relates to CWE-20, Improper Input Validation, as the system fails to properly validate and sanitize complex nested structures before processing them through recursive logic. In terms of attack vectors, this falls under ATT&CK technique T1496, Resource Hijacking, specifically involving denial of service via resource exhaustion such as CPU or memory consumption leading to application crash. The vulnerability represents a classic case where logical flaws in data structure handling lead to catastrophic system instability.
To mitigate this risk, organizations using kin-openapi must upgrade immediately to version 0.149.0 or later, which implements proper cycle detection during the validation phase. For environments that cannot patch instantly, implementing strict input size limits and depth restrictions on incoming JSON payloads can help reduce the likelihood of triggering deep recursion before it reaches the vulnerable code paths. Additionally, deploying a Web Application Firewall with rules designed to detect unusually complex nested JSON structures may provide an additional layer of defense against exploitation attempts until the underlying library is updated.