CVE-2026-97394High· 7.5▾ MidnightPoC availablekin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.143.0, openapi3filter accepts OpenAPI 3.1 array schemas without an items keyword and then dereferences the nil Schema.Items value while decoding application/x-w…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 41.3 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 16.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.4%
Exploit / PoC code exists
0.4% → 0.6%
kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.143.0, openapi3filter accepts OpenAPI 3.1 array schemas without an items keyword and then dereferences the nil Schema.Items value while decoding application/x-www-form-urlencoded or multipart/form-data request bodies, response headers, and other array parameter surfaces. A remote unauthenticated client can reach an affected operation with a nonempty request or matching response and deterministically trigger a nil-pointer panic during ValidateRequest or ValidateResponse. OpenAPI 3.0 documents are not affected because document validation rejects arrays without items, and JSON request bodies use a different decoder path. This issue is fixed in version 0.143.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
github.com/getkin/kin-openapi >= 0.136.0, < 0.143.0Patched in:
github.com/getkin/kin-openapi 0.143.0Source: https://github.com/advisories/GHSA-p6wj-qrr4-pgh5
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-100347Medium· 5.3kin-openapi is a Go project for handling OpenAPI files
CVE-2026-100348Medium· 5.3kin-openapi is a Go project for handling OpenAPI files
CVE-2026-100349High· 8.2kin-openapi is a Go project for handling OpenAPI files
CVE-2026-100351High· 7.4kin-openapi is a Go project for handling OpenAPI files
CVE-2026-100352High· 7.5kin-openapi is a Go project for handling OpenAPI files
CVE-2026-100353High· 7.5kin-openapi is a Go project for handling OpenAPI files