kin-openapi CVE-2026-100354

Exploitation requires the target service to be running kin-openapi before version 0.149.0 AND to have loaded an OpenAPI document containing an allOf, anyOf, or oneOf chain that refers back to an ancestor schema (a circular reference that the loader and document validation accept without error). The attacker must then send a request (or elicit a response) that reaches that recursive schema so runtime validation via Schema.visitJSON or openapi3filter.decodeValue is invoked. The primary LIMITING factor is that the vulnerable circular schema must exist in the deployed spec - a default/non-circular spec is not affected - so this is not exploitable against all kin-openapi deployments; no authentication or user interaction is required once the condition is present.

This is a denial-of-service vulnerability (CWE-674, uncontrolled recursion) with a CVSS 3.1 base score of 7.5 driven entirely by availability (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - C:N/I:N/A:H), so there is no confidentiality or integrity impact. The signals are largely consistent: network vector, low complexity, and no privileges or user interaction required, which supports the high availability score because a single crafted request can trigger an unrecoverable fatal stack overflow that terminates the whole Go process (including unrelated in-flight requests), not just the offending request. However, the real-world risk is gated by a precondition the CVSS vector does not capture: the server must be running an OpenAPI spec that itself contains a circular allOf/anyOf/oneOf reference back to an ancestor schema. No EPSS score, KEV listing, or SSVC decision data was provided in the input, and no public exploit code was supplied (only the vendor fix commit and a regression test). This is therefore a genuine but conditional priority - severe impact (total process crash) and trivial to trigger once the vulnerable spec condition exists, but not universally exploitable against every kin-openapi deployment. Note the input Tags label this a 'Buffer Overflow,' which conflicts with the actual CWE-674 stack-exhaustion-via-recursion mechanism; the two are distinct and this discrepancy should be corrected.

A Go service uses kin-openapi (before 0.149.0) with an OpenAPI document whose schema contains a self-referential allOf/anyOf/oneOf chain that the loader and document validation accept. An unauthenticated remote attacker sends a single HTTP request to an endpoint whose parameter or body maps to that recursive schema; runtime validation (Schema.visitJSON or openapi3filter.decodeValue) recurses until the goroutine stack is exhausted, producing a fatal runtime error that cannot be recovered and crashes the entire process, dropping all concurrent requests. No public exploit code was provided, though the vendor commit includes a regression test demonstrating the crash condition.