[ Vendor · 9 CVEs ]
getkin
CVEs affecting getkin published in the last 30 days, plus any getkin CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-100353 | 15 Oct 2026 | CVSS 7.5 | kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filterkin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.149.0, three openapi3filter decoder paths that were missed by the fix… | Fix |
| CVE-2026-100354 | 15 Oct 2026 | CVSS 7.5 | kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crashkin-openapi is a Go project for handling OpenAPI files. Prior to 0.149.0, runtime request, response, and direct schema validation lacks cycle… | Fix |
| CVE-2026-97394 | 15 Oct 2026 | CVSS 7.5 | kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing itemskin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.143.0, openapi3filter accepts OpenAPI 3.1 array schemas without an items… | Fix |
| CVE-2026-100351 | 15 Oct 2026 | CVSS 7.4 | kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusionkin-openapi is a Go project for handling OpenAPI files. From 0.144.0 until 0.147.0, openapi3filter.ValidationHandler validates an operation selected… | Fix |
| CVE-2026-100352 | 15 Oct 2026 | CVSS 7.5 | kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Pathkin-openapi is a Go project for handling OpenAPI files. Prior to 0.148.0, the OpenAPI 3.1 validation path passes YAML NaN and infinity numeric values… | Fix |
| CVE-2026-100347 | 15 Oct 2026 | CVSS 5.3 | kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static pathkin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3filter.ValidationHandler uses the routers/legacy router, which… | Fix |
| CVE-2026-100348 | 15 Oct 2026 | CVSS 5.3 | kin-openapi spec loader panics on a self-referential additionalProperties $ref (nil-pointer DoS)kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3.Loader can dereference a nil SchemaRef.Value while resolving a… | Fix |
| CVE-2026-100349 | 15 Oct 2026 | CVSS 8.2 | kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with contentkin-openapi is a Go project for handling OpenAPI files. Prior to 0.146.0, openapi3filter.ValidateResponse passes a nil response header schema to… | Fix |
| CVE-2026-100350 | 15 Oct 2026 | CVSS 5.3 | kin-openapi deepObject query decoding repeatedly compiles an invariant regular expressionkin-openapi is a Go project for handling OpenAPI files. From 0.145.0 until 0.146.0, openapi3filter repeatedly calls regexp.MustCompile for the same… | Fix |