getkin has 12 CVEs on record. Disclosure cadence is accelerating: 10 in the last 90 days against 2 in the 90 before. The busiest recent month was October 2026 with 9. The median CVSS is 7.5 (high), with 1 rated critical. None have a confirmed exploitation report. The most common weakness class is CWE-476 (6). Most affected products: kin-openapi (9), github.com/getkin/kin-openapi (3).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.5
- Publish → KEV
- —
- Last 90 days
- 10 prev 2
Weakness classes
Products
- kin-openapi 9
- github.com/getkin/kin-openapi 3
Worst active — by depth score
CVE-2026-97394High· 7.5kin-openapi is a Go project for handling OpenAPI files53CVE-2026-100354High· 7.5kin-openapi is a Go project for handling OpenAPI files53CVE-2026-100352High· 7.5kin-openapi is a Go project for handling OpenAPI files53CVE-2026-100351High· 7.4kin-openapi is a Go project for handling OpenAPI files53GHSA-r277-6w6q-xmqwCritical· 9.1kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default50
getkin vulnerabilities
CVEs affecting getkin, newest first. Open any entry for full detail, references, and exploit status.
12 CVEsRSS
CVE-2026-100354High· 7.5PoCkin-openapi is a Go project for handling OpenAPI files
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.149.0, runtime request, response, and direct schema validation lacks cycle detection when an allOf, anyOf, or oneOf chain refers back to an ancestor schema, even though l…
CVE-2026-100353High· 7.5kin-openapi is a Go project for handling OpenAPI files
kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.149.0, three openapi3filter decoder paths that were missed by the fix for GHSA-p6wj-qrr4-pgh5 lack a nil-items guard for legal OpenAPI 3.1 array schemas. An una…
CVE-2026-97394High· 7.5PoCkin-openapi is a Go project for handling OpenAPI files
kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.143.0, openapi3filter accepts OpenAPI 3.1 array schemas without an items keyword and then dereferences the nil Schema.Items value while decoding application/x-w…
CVE-2026-100347Medium· 5.3PoCkin-openapi is a Go project for handling OpenAPI files
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3filter.ValidationHandler uses the routers/legacy router, which passes an unsupported or non-canonical HTTP method for an existing static path to openapi3.P…
CVE-2026-100350Medium· 5.3PoCkin-openapi is a Go project for handling OpenAPI files
kin-openapi is a Go project for handling OpenAPI files. From 0.145.0 until 0.146.0, openapi3filter repeatedly calls regexp.MustCompile for the same parameter-name regular expression inside the per-query-key loop in urlValuesDecoder.Decod…
CVE-2026-100348Medium· 5.3kin-openapi is a Go project for handling OpenAPI files
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3.Loader can dereference a nil SchemaRef.Value while resolving a self-referential additionalProperties JSON Reference such as a schema that points to its ow…
CVE-2026-100349High· 8.2kin-openapi is a Go project for handling OpenAPI files
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.146.0, openapi3filter.ValidateResponse passes a nil response header schema to decodeValue when an OpenAPI document declares the header with content instead of schema. The…
CVE-2026-100351High· 7.4PoCkin-openapi is a Go project for handling OpenAPI files
kin-openapi is a Go project for handling OpenAPI files. From 0.144.0 until 0.147.0, openapi3filter.ValidationHandler validates an operation selected from decoded URL.Path while a downstream gorilla/mux router configured with UseEncodedPa…
CVE-2026-100352High· 7.5PoCkin-openapi is a Go project for handling OpenAPI files
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.148.0, the OpenAPI 3.1 validation path passes YAML NaN and infinity numeric values to santhosh-tekuri/jsonschema v6.0.2 without applying kin-openapi's existing finite-num…
CVE-2026-77354High· 7.5kin-openapi is a Go project for handling OpenAPI files
kin-openapi is a Go project for handling OpenAPI files. From 0.124.0 until 0.142.0, openapi3filter.sliceMapToSlice in openapi3filter/req_resp_decoder.go converts attacker-controlled sparse indexes from a deepObject query parameter into a…
GHSA-jpcw-4wr7-c3vqMedium· 5.3kin-openapi openapi3filter: unauthenticated nil-pointer panic when validating a request against a `content` parameter whose media type has no schema
kin-openapi openapi3filter: unauthenticated nil-pointer panic when validating a request against a `content` parameter whose media type has no schema
GHSA-r277-6w6q-xmqwCritical· 9.1kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default
kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default