kin-openapi EUVD-2026-102143

Exploitation requires the target to run kin-openapi 0.136.0 through 0.142.x AND to serve an OpenAPI 3.1 document that declares a type: array schema without an items keyword on an affected surface: an application/x-www-form-urlencoded or multipart/form-data request body, a response header, or other array parameter. The attacker then needs only a single nonempty request (or, for ValidateResponse, a matching response) reaching that operation - no authentication (PR:N) and no user interaction (UI:N). Limiting factors: OpenAPI 3.0 documents are explicitly unaffected because document validation rejects arrays without items; JSON request bodies use a different decoder and are not affected; and the vulnerable schema shape must actually be present in the deployed spec, so services using only well-formed 3.1 schemas or 3.0 specs are not exposed.

This is a genuine but bounded availability risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes a remote, unauthenticated, low-complexity denial of service with no confidentiality or integrity impact - consistent with CWE-248 (uncaught exception) and the described nil-pointer panic. No EPSS score, KEV listing, or public exploit was provided in the input, so there is no public exploit identified at time of analysis; the GitHub commit contains only the vendor's regression test, which is NOT a weaponized proof-of-concept. The key limiting factor is a deployment precondition not captured by the base CVSS: the vulnerability only triggers when the target server serves an OpenAPI 3.1 document containing a type: array schema with no items keyword on an affected surface, and validation (ValidateRequest/ValidateResponse) runs against it. The supplied 'Information Disclosure' tag conflicts with the CVSS vector (C:N/I:N, A:H) - this is an availability/DoS issue, not information disclosure, and the tag appears mislabeled. Net: treat as a real but conditional DoS priority for Go services embedding affected kin-openapi versions with 3.1 specs; lower urgency where only OpenAPI 3.0 docs or JSON-only bodies are used, since those code paths are explicitly stated as unaffected.

A Go backend uses kin-openapi (0.136.0-0.142.x) with an OpenAPI 3.1 spec that declares an array schema without items on a form/multipart request body or array parameter. A remote unauthenticated attacker sends a single nonempty request to that operation; during ValidateRequest the decoder dereferences the nil Schema.Items, panicking and crashing the handler/service. No public weaponized exploit is identified at time of analysis, though the trigger is deterministic and trivial to reproduce from the public description.