CVE-2026-100352
CVE-2026-100352 · kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path
This page contains facts from public vulnerability sources. Check the original advisory before updating.
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.148.0, the OpenAPI 3.1 validation path passes YAML NaN and infinity numeric values to santhosh-tekuri/jsonschema v6.0.2 without applying kin-openapi's existing finite-number guards. A remote unauthenticated client can send an application/yaml or application/x-yaml request body containing .nan, .inf, or -.inf to an operation with a numeric constraint, causing the dependency to create and dereference a nil big.Rat during ValidateRequest. Standard net/http servers recover the panic per connection, while other hosts or application goroutines may terminate the process. This issue is fixed in version 0.148.0.
CVSS 7.5 · High · EPSS 0.4%
- Published
- Updated
Stack: system
Affected products and versions
kin-openapi
- Versions
- < 0.148.0: Affected
No fix published
golang-github-getkin-kin-openapi Ubuntu:22.04:LTS
- Versions
- 0.32.0-2
- 0.80.0-1
- 0.85.0-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-github-getkin-kin-openapi Ubuntu:24.04:LTS
- Versions
- 0.117.0-1
- 0.120.0-1
- 0.122.0-3
- 0.123.0-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-github-getkin-kin-openapi Ubuntu:26.10
- Versions
- 0.124.0-1
- 0.135.0-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-github-getkin-kin-openapi Ubuntu:26.04:LTS
- Versions
- 0.124.0-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published