kin-openapi CVE-2026-100350

Exploitation requires the target application to invoke openapi3filter.ValidateRequest and to define at least one query parameter using the deepObject serialization style in its OpenAPI schema; the vulnerable code path (urlValuesDecoder.DecodeObject) only runs for such parameters. The library version must be between 0.145.0 and 0.146.0. No authentication or user interaction is needed (PR:N/UI:N), but effective impact scales with the attacker's ability to send large numbers of query keys and sustain request volume, and is limited by any upstream request-size limits, rate limiting, or WAF query-parameter caps in front of the service.

This is a genuine but modest-severity denial-of-service issue (CWE-400) rather than a high-priority emergency. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, base 5.3) is internally consistent with the description: an unauthenticated network attacker can trigger CPU/allocation work proportional to the number of attacker-supplied query keys because regexp.MustCompile was called loop-invariantly inside the per-query-key loop of urlValuesDecoder.DecodeObject. Impact is correctly scoped to availability-only (C:N/I:N) and rated Low (A:L) because this is amplified resource consumption, not a full crash or guaranteed outage - the author explicitly notes it is NOT ReDoS. No EPSS score, no CISA KEV entry, and no public exploit were provided, so exploitation signals are weak: no public exploit identified at time of analysis. The vendor advisory (GHSA-h4r5-mxv5-8mjc) and the fixing commit are confirmed, and the fix is a classic hoist-compilation-out-of-loop change, which supports the DoS-only classification. Net: real but low-urgency - patch in normal maintenance cycles, with priority raised only for internet-facing Go services that validate deepObject query parameters at high request volumes.

An attacker identifies an internet-facing Go service that uses kin-openapi's openapi3filter.ValidateRequest and exposes an endpoint whose OpenAPI spec defines a deepObject-style query parameter. They repeatedly send requests packed with hundreds or thousands of unrelated query keys, forcing the server to recompile the same regular expression once per key per deepObject parameter, inflating CPU and memory usage. No public exploit code is available, but the attack is trivial to script given the low complexity and lack of authentication.