kin-openapi CVE-2026-100352

The target must run kin-openapi before 0.148.0 and route validation through the OpenAPI 3.1 path (useJSONSchema2020), which bypasses kin-openapi's existing finite-number guards in visitJSON; the validated operation must declare a numeric constraint (e.g. 'type: number' with 'minimum'), the endpoint must accept an application/yaml or application/x-yaml request body, and the service must invoke ValidateRequest on that input. No authentication is required (PR:N). LIMITING FACTORS: services on 3.0 specs, services not accepting YAML bodies, or operations without numeric constraints are unaffected; and because standard net/http recovers the panic per connection, impact is often limited to a single dropped request - full process termination requires a non-net/http host or a panic raised within an application goroutine.

This is a genuine but bounded denial-of-service issue, not a high-impact priority flaw. The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) correctly reflects an availability-only impact reachable by remote unauthenticated clients, and CWE-754 (improper check for unusual conditions) matches the root cause: unguarded YAML NaN/infinity values reaching santhosh-tekuri/jsonschema v6.0.2, which dereferences a nil big.Rat. However, the A:H rating is optimistic for the common case: the description itself states that standard net/http servers recover the panic per connection, so the realistic impact there is a single failed request rather than full outage - full process termination only occurs on non-net/http hosts or when the panic propagates in application goroutines. No EPSS score, KEV listing, or public exploit was provided; exploitation status is therefore 'no public exploit identified at time of analysis.' The commit adds only a regression test (not a weaponized exploit) and bumps the dependency to v6.0.3. CONFLICT TO NOTE: the input Tag 'Information Disclosure' directly contradicts the CVSS vector (C:N, I:N, A:H) - this is an availability/DoS issue with no confidentiality impact, so the tag appears mislabeled. Overall this warrants routine patching for affected deployments rather than emergency response.

An attacker identifies a Go service using kin-openapi (<0.148.0) that validates requests against an OpenAPI 3.1 spec with a numeric constraint and accepts YAML bodies. They send an unauthenticated POST with Content-Type application/yaml and a body of '.nan', '.inf', or '-.inf', which during ValidateRequest triggers a nil big.Rat dereference in the jsonschema dependency. On standard net/http this crashes the serving goroutine (recovered per connection), but on other hosts or in application goroutines it can terminate the whole process; no public exploit code was identified, though the fix commit demonstrates the trigger clearly.