CVE-2026-100347 getkin CVE debrief

Who should care

Defenders responsible for the kin-openapi library, as well as developers and administrators using this library in their applications, should assess exposure and verify remediation for this vulnerability.

Why it matters

CVE-2026-100347 is an unauthenticated, remotely triggerable denial of service vulnerability in the kin-openapi library. Defenders should prioritize assessing exposure and verifying remediation, as this vulnerability can be exploited without authentication, potentially leading to a denial of service.

• Unauthenticated denial of service
• Remotely triggerable panic and error-log growth
• Potential for recovered per-connection panic

Technical summary

The `openapi3filter.ValidationHandler` middleware hard-wires the legacy router, which matches incoming request methods verbatim against a trie built exclusively from upper-cased canonical HTTP methods. A request with a non-canonical or unsupported HTTP method can cause a panic before authentication runs, leading to a denial of service. The vulnerability is caused by the `openapi3filter/validation_handler.go:39` and `routers/legacy/router.go:109` files, which do not canonicalize or reject non-standard HTTP methods. This issue is fixed in version 0.145.0 of the kin-openapi library, and defenders should prioritize assessing exposure and verifying remediation.

Defensive priority

Defenders should prioritize assessing exposure and verifying remediation for this vulnerability, as it can be exploited without authentication.

Recommended defensive actions

• Assess exposure by checking if the kin-openapi library is used in the environment
• Verify if the version of the kin-openapi library is 0.145.0 or later
• Implement compensating controls, such as rate limiting or IP blocking, to mitigate the vulnerability
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by the `openapi3filter/validation_handler.go:39` and `routers/legacy/router.go:109` files, which do not canonicalize or reject non-standard HTTP methods. This issue is fixed in version 0.145.0 of the kin-openapi library.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.