CVE-2026-100352 getkin CVE debrief

Who should care

Defenders responsible for Go applications using the kin-openapi library, particularly those handling YAML input or using OAS 3.1 specs, should assess exposure and prioritize updating to a fixed version.

Why it matters

Defenders should care about CVE-2026-100352 because it allows an attacker to cause a panic in the kin-openapi library, potentially disrupting service. The issue arises from the library's handling of NaN and Inf values in YAML input for OAS 3.1 specs. Roles responsible for Go application security, particularly those handling YAML input or using OAS 3.1 specs, should assess exposure and prioritize updating to version 0.148.0 or later of the kin-openapi library.

• Potential service disruption via panic
• Increased risk of denial-of-service attacks
• Need for verification of input data handling
• Priority for updating to a fixed library version

Technical summary

The kin-openapi library does not properly handle NaN and Inf values in YAML input for OAS 3.1 specs, leading to a panic when these values are used in numeric constraints. This occurs because the library uses `santhosh-tekuri/jsonschema/v6` v6.0.2 for OAS 3.1 specs without applying the same guard against NaN and Inf values as in its built-in schema visitor. As a result, a silent parse failure occurs, and a subsequent panic happens when comparing the nil `*big.Rat`. An attacker can exploit this by sending an HTTP request with `Content-Type: application/yaml` (or `application/x-yaml`) and a YAML body containing `.nan`, `.inf`, or `-.inf`. The `YamlBodyDecoder` decodes those tokens into `math.NaN()` / `math.Inf(±1)

Defensive priority

Defenders should prioritize verifying and updating to version 0.148.0 or later of the kin-openapi library to prevent potential service disruption via panic.

Recommended defensive actions

• Verify and update to version 0.148.0 or later of the kin-openapi library
• Review and validate input data to prevent NaN and Inf values from propagating to the vulnerable code path
• Implement additional monitoring and logging to detect potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The issue is caused by the library's use of `santhosh-tekuri/jsonschema/v6` v6.0.2 for OAS 3.1 specs without applying the same guard against NaN and Inf values as in its built-in schema visitor. This leads to a silent parse failure and a subsequent panic when comparing the nil *big.Rat.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.