CVE-2026-100354 getkin CVE debrief

Who should care

Defenders responsible for systems using the kin-openapi library, particularly those using versions prior to 0.149.0, should assess exposure and prioritize remediation to prevent potential denial-of-service conditions.

Why it matters

The vulnerability in kin-openapi can lead to a fatal process crash, causing a denial-of-service condition. Defenders should prioritize assessing exposure, verifying inventory, and remediating affected systems to prevent potential impact on system availability and reliability.

• Denial-of-service condition due to process termination
• Potential impact on system availability and reliability
• Need for verification of inventory and remediation of affected systems

Technical summary

The kin-openapi library's spec loader and spec-time validator handle circular schema references safely, but the runtime validators do not. When a schema with circular allOf/anyOf/oneOf references is used for validation, it leads to unbounded recursion, causing a fatal stack overflow error in Go. This error terminates the entire process, including all goroutines serving unrelated clients. The vulnerability is confirmed in kin-openapi versions prior to 0.149.0. Two independent unguarded recursion sites were identified in the library's code. Defenders should prioritize assessing exposure and verifying inventory for systems using the affected kin-openapi library versions, as the vulnerability can lead to a denial-

Defensive priority

Defenders should prioritize assessing exposure and verifying inventory for systems using the affected kin-openapi library versions, as the vulnerability can lead to a denial-of-service condition. Remediation involves updating to version 0.149.0 or later.

Recommended defensive actions

• Assess exposure and verify inventory for systems using kin-openapi library versions prior to 0.149.0
• Update kin-openapi to version 0.149.0 or later
• Monitor for potential denial-of-service conditions
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability is confirmed in kin-openapi versions prior to 0.149.0. Two independent unguarded recursion sites were identified in the library's code. The CVE record and source item provide details on the issue and its impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.