CVE-2026-100353 getkin CVE debrief

Who should care

Defenders responsible for systems using the kin-openapi package, particularly those handling OpenAPI 3.1 array schemas, should assess exposure and verify remediation to prevent potential nil-pointer panics during request validation.

Why it matters

CVE-2026-100353 is significant for defenders responsible for systems using the kin-openapi package, as an incomplete fix for GHSA-p6wj-qrr4-pgh5 leaves three unpatched nil-Items panic paths in openapi3filter. These paths can be triggered by unauthenticated clients, leading to a deterministic nil-pointer panic during request validation. Defenders should assess exposure, verify remediation, and monitor for potential attacks.

• Verification of inventory and remediation priority for affected kin-openapi package versions.
• Assessment of exposure for systems handling OpenAPI 3.1 array schemas.
• Monitoring for unauthenticated requests triggering nil-pointer panics during request validation.
• Remediation by updating to kin-openapi package version v0.149.0 or later.

Technical summary

The fix for GHSA-p6wj-qrr4-pgh5 in kin-openapi did not address three additional nil-Items panic paths in openapi3filter: query parameters with type: array and no items, deepObject query parameters with array properties and no items, and URL-encoded request bodies with arrays inside allOf/anyOf/oneOf sub-schemas. These paths can be triggered by unauthenticated clients, leading to a deterministic nil-pointer panic during request validation.

Defensive priority

Defenders should prioritize assessing exposure and verifying remediation for systems using the affected kin-openapi package versions, particularly those handling OpenAPI 3.1 array schemas.

Recommended defensive actions

• Assess exposure for systems using kin-openapi package versions prior to v0.149.0.
• Verify remediation by updating to kin-openapi package version v0.149.0 or later.
• Monitor for unauthenticated requests triggering nil-pointer panics during request validation.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

Evidence is based on the supplied source corpus from osv_dev and CVE Program records, detailing the incomplete fix for GHSA-p6wj-qrr4-pgh5 and the existence of three additional unpatched panic paths. The evidence is grounded in official CVE metadata and source-provided details. However, the exact scope of affected systems and potential impact on specific deployments are unknown. Defenders should verify remediation by updating to kin-openapi package version v0.149.0 or later and monitor for unauthenticated requests triggering nil-

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.