CVE-2026-100348

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3.Loader can dereference a nil SchemaRef.Value while resolving a self-referential additionalProperties JSON Reference such as a schema that points to its own additionalProperties member. Loading an attacker-controlled OpenAPI document through LoadFromData, LoadFromFile, or LoadFromURI reaches resolveComponent before document validation and can panic the loading process. Resolved additionalProperties schemas and ordinary recursive schemas do not take the vulnerable nil-value path. This issue is fixed in version 0.145.0.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/getkin/kin-openapi/commit/88aa64c7cbd03ecadbb419c473bdcaa8b0124c6b
https://github.com/getkin/kin-openapi/releases/tag/v0.145.0
https://github.com/getkin/kin-openapi/security/advisories/GHSA-mh7x-f8wq-4jhx

Configurations

No configuration.

History

15 Oct 2026, 16:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-15 16:17

Updated : 2026-10-15 16:17

NVD link : CVE-2026-100348

Mitre link : CVE-2026-100348

CVE.ORG link : CVE-2026-100348

JSON object : View

Products Affected

No product.

CWE

CWE-476

NULL Pointer Dereference

{"id": "CVE-2026-100348", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-100348", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-15T15:44:05.626471Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "getkin", "product": "kin-openapi", "versions": [{"status": "affected", "version": "< 0.145.0"}]}]}], "published": "2026-10-15T16:17:30.477", "references": [{"url": "https://github.com/getkin/kin-openapi/commit/88aa64c7cbd03ecadbb419c473bdcaa8b0124c6b", "source": "security-advisories@github.com"}, {"url": "https://github.com/getkin/kin-openapi/releases/tag/v0.145.0", "source": "security-advisories@github.com"}, {"url": "https://github.com/getkin/kin-openapi/security/advisories/GHSA-mh7x-f8wq-4jhx", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-476"}]}], "descriptions": [{"lang": "en", "value": "kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3.Loader can dereference a nil SchemaRef.Value while resolving a self-referential additionalProperties JSON Reference such as a schema that points to its own additionalProperties member. Loading an attacker-controlled OpenAPI document through LoadFromData, LoadFromFile, or LoadFromURI reaches resolveComponent before document validation and can panic the loading process. Resolved additionalProperties schemas and ordinary recursive schemas do not take the vulnerable nil-value path. This issue is fixed in version 0.145.0."}], "lastModified": "2026-10-15T16:17:30.607", "sourceIdentifier": "security-advisories@github.com"}