kin-openapi CVE-2026-100348

The host application must load an attacker-controlled OpenAPI document via kin-openapi's LoadFromData, LoadFromFile, or LoadFromURI, and that document must contain a self-referential additionalProperties JSON Reference - a schema whose $ref points to its own additionalProperties member (e.g. A: {$ref: '#/components/schemas/A/additionalProperties'}). The nil SchemaRef.Value dereference occurs inside resolveComponent BEFORE doc.Validate runs, so input validation does not block it. Limiting factors: exposure exists only in applications that accept and load untrusted/attacker-supplied specs - deployments that load only trusted, static OpenAPI files are not affected; already-resolved additionalProperties schemas and ordinary recursive schemas do not reach the vulnerable path; and only versions prior to 0.145.0 are affected. No authentication is required (PR:N) once such an input path is reachable.

This is a moderate-severity availability issue, not a top-tier priority. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, score 5.3) is consistent with the description: a remote, unauthenticated, low-complexity trigger with impact limited strictly to availability (C:N/I:N) via a nil-pointer panic (CWE-476). No EPSS score, no CISA KEV listing, and no SSVC decision data were supplied in the input, so exploitation probability and automatability cannot be quantified from the data given. A public reproducer exists in the fix commit (a 27-line test with a minimal triggering spec), which lowers the skill barrier, but a reproducer is not evidence of active exploitation and must not be conflated with it. The real-world risk is sharply gated by deployment context: this is a Go library, not a standalone service, so impact only materializes in applications that load attacker-controlled OpenAPI documents through LoadFromData/LoadFromFile/LoadFromURI. Where that pattern exists, an attacker can crash the loading goroutine/process with a tiny crafted document and no authentication; where specs are trusted and static, exposure is effectively nil. Net: a legitimate but context-dependent DoS to patch on a normal cycle, not an emergency.

An application uses kin-openapi (prior to 0.145.0) to load and parse user-submitted OpenAPI specifications - for example an API gateway, spec validator, or SaaS import feature. An attacker uploads a crafted OpenAPI document containing a schema whose $ref points to its own additionalProperties member (e.g. '#/components/schemas/A/additionalProperties'), and the loader dereferences a nil SchemaRef.Value in resolveComponent before validation runs, panicking the process. A public reproducer (minimal spec) is present in the fix commit, making the trigger trivial to construct.