CVE-2026-100350Medium· 5.3▾ TwilightPoC availablekin-openapi is a Go project for handling OpenAPI files. From 0.145.0 until 0.146.0, openapi3filter repeatedly calls regexp.MustCompile for the same parameter-name regular expression inside the per-query-key loop in urlValuesDecoder.Decod…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 29.2 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 16.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Exploit / PoC code exists
0.5%
kin-openapi is a Go project for handling OpenAPI files. From 0.145.0 until 0.146.0, openapi3filter repeatedly calls regexp.MustCompile for the same parameter-name regular expression inside the per-query-key loop in urlValuesDecoder.DecodeObject used to decode a deepObject query parameter. An unauthenticated remote client can send an affected endpoint a request containing many unrelated query keys, causing ValidateRequest to perform work and allocations proportional to the attacker-controlled key count for every deepObject parameter. The expression itself is fixed and this is not regular expression denial of service; the resource consumption comes from loop-invariant recompilation. This issue is fixed in version 0.146.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
github.com/getkin/kin-openapi >= 0.145.0, < 0.146.0Patched in:
github.com/getkin/kin-openapi 0.146.0Source: https://github.com/advisories/GHSA-h4r5-mxv5-8mjc
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-100349High· 8.2kin-openapi is a Go project for handling OpenAPI files
CVE-2026-100354High· 7.5kin-openapi is a Go project for handling OpenAPI files
CVE-2026-97394High· 7.5kin-openapi is a Go project for handling OpenAPI files
CVE-2026-100347Medium· 5.3kin-openapi is a Go project for handling OpenAPI files
CVE-2026-100351High· 7.4kin-openapi is a Go project for handling OpenAPI files
CVE-2026-100352High· 7.5kin-openapi is a Go project for handling OpenAPI files