kin-openapi CVE-2026-100347

The target service must use kin-openapi's openapi3filter.ValidationHandler backed by the routers/legacy router, and its OpenAPI spec must contain at least one exact static path (a path matched only by a templated/parameterized route does NOT reach the vulnerable sink). The attacker then sends an unsupported or non-canonical HTTP method (e.g. PROPFIND, or lowercase 'get') to that static path; the panic fires in PathItem.GetOperation before authentication, so no credentials are required (PR:N). Limiting factors: impact is bounded to per-connection aborts and stack-trace log growth rather than a full process crash (Go recovers per-request panics by default), affected versions are prior to 0.145.0, and services not using the legacy-router ValidationHandler path or lacking static paths are not exposed.

This is a genuinely low-to-moderate priority issue despite the unauthenticated remote attack surface. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, base 5.3) is internally consistent with the description: a remote, unauthenticated client can trigger the condition with low complexity, and the only impact is a limited availability hit (C:N/I:N, A:L). There is no EPSS score, no CISA KEV listing, and no public exploit code referenced in the provided data - exploitation status is therefore 'no public exploit identified at time of analysis.' Crucially, the real-world impact is constrained: a Go net/http server recovers per-request panics by default, so this aborts the individual connection and inflates stack-trace logs rather than crashing the whole service, which matches A:L rather than A:H. The practical risk is disk/log exhaustion and noise under sustained abuse, not a service-wide outage, and it only applies to deployments that use openapi3filter.ValidationHandler backed by the legacy router with at least one exact static path. No key signals conflict here; the main unknown is how many downstream services actually wire up the vulnerable handler/router combination.

An unauthenticated attacker repeatedly sends HTTP requests using unsupported or non-canonical methods (e.g. PROPFIND, or lowercase 'get') against an exact static path that exists in the OpenAPI spec of a service using kin-openapi's openapi3filter.ValidationHandler with the legacy router. Each request triggers a panic in PathItem.GetOperation before authentication runs, aborting the connection and writing a full stack trace to logs; sustained requests grow logs and add CPU/IO noise. No public proof-of-concept is referenced in the provided data.