getkin kin-openapi up to 0.148.x Schema Validation Schema.visitJSON stack-based overflow

Summaryinfo

A vulnerability was found in getkin kin-openapi up to 0.148.x. It has been rated as problematic. This issue affects the function Schema.visitJSON of the component Schema Validation. This manipulation causes stack-based overflow. This vulnerability is handled as CVE-2026-100354. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in getkin kin-openapi up to 0.148.x. It has been declared as problematic. Affected by this vulnerability is the function Schema.visitJSON of the component Schema Validation. The manipulation with an unknown input leads to a stack-based overflow vulnerability. The CWE definition for the vulnerability is CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). As an impact it is known to affect availability. The summary by CVE is:

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.149.0, runtime request, response, and direct schema validation lacks cycle detection when an allOf, anyOf, or oneOf chain refers back to an ancestor schema, even though loading and document validation accept the circular reference. A request or response that reaches the affected schema causes unbounded recursion in Schema.visitJSON or openapi3filter.decodeValue and exhausts the Go goroutine stack. The resulting fatal stack overflow cannot be caught with recover and terminates the entire process, including unrelated requests. This issue is fixed in version 0.149.0.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-100354 since 09/25/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are known, but no exploit is available.

Upgrading to version 0.149.0 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• getkin

Name

• kin-openapi

Version

• 0.148

Website

• Product: https://github.com/getkin/kin-openapi/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion