CVE-2026-100348 getkin CVE debrief

Who should care

Defenders responsible for services or tools that load untrusted OpenAPI specifications via the default openapi3.Loader should assess exposure and prioritize verification and updates to affected versions of the kin-openapi library.

Why it matters

Defenders should prioritize verifying and updating affected versions of the kin-openapi library to prevent potential denial-of-service (DoS) attacks. The issue is confirmed at version 0.144.0, and updating to version 0.145.0 or later is recommended. Evidence is limited to the supplied source corpus and official CVE record.

• Potential denial-of-service (DoS) attacks against services or tools that load untrusted OpenAPI specifications.
• Verification priority for affected versions of the kin-openapi library.
• Remediation priority for updating to version 0.145.0 or later.

Technical summary

The kin-openapi library's OpenAPI specification loader panics when encountering a self-referential additionalProperties $ref in a crafted OpenAPI document. This issue is caused by a missing nil-check on c.Value in the resolveComponent's drill closure, which can lead to a denial-of-service (DoS) condition. The vulnerability affects services or tools that load untrusted specifications via the default openapi3.Loader, and updating to version 0.145.0 or later is recommended to mitigate the issue. The vulnerability is triggered by a specific type of crafted OpenAPI document that causes a nil-pointer dereference.

Defensive priority

Defenders should prioritize verifying and updating affected versions of the kin-openapi library to prevent potential denial-of-service (DoS) attacks.

Recommended defensive actions

• Verify and update affected versions of the kin-openapi library to version 0.145.0 or later.
• Implement input validation and sanitization for OpenAPI specifications to prevent loading of crafted documents.
• Monitor for and respond to potential DoS attacks targeting services or tools that use the kin-openapi library.
• Review and update incident response plans to include procedures for handling potential DoS attacks.
• Conduct a thorough review of the kin-openapi library's usage in the organization and prioritize updates to affected versions.
• Consider implementing additional security controls, such as rate limiting or IP blocking, to mitigate potential DoS attacks.
• Track and analyze logs for signs of potential DoS attacks or exploitation attempts.

Evidence notes

The issue is confirmed at version 0.144.0 of the kin-openapi library. A crafted OpenAPI document with a self-referential additionalProperties $ref can cause the loader to panic. Evidence is limited to the supplied source corpus and official CVE record. The vulnerability is caused by a missing nil-check on c.Value in the resolveComponent's drill closure, which can lead to a panic when encountering a self-referential $ref in the additionalProperties section of a schema.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.