CVE-2026-100350

kin-openapi is a Go project for handling OpenAPI files. From 0.145.0 until 0.146.0, openapi3filter repeatedly calls regexp.MustCompile for the same parameter-name regular expression inside the per-query-key loop in urlValuesDecoder.DecodeObject used to decode a deepObject query parameter. An unauthenticated remote client can send an affected endpoint a request containing many unrelated query keys, causing ValidateRequest to perform work and allocations proportional to the attacker-controlled key count for every deepObject parameter. The expression itself is fixed and this is not regular expression denial of service; the resource consumption comes from loop-invariant recompilation. This issue is fixed in version 0.146.0.

• CWE-400
• CWE-770
• CWE-1050

• https://github.com/getkin/kin-openapi/commit/d090e36b2f1c42c898ba2a687a8f6e25f5ca727f
• https://github.com/getkin/kin-openapi/releases/tag/v0.146.0
• https://github.com/getkin/kin-openapi/security/advisories/GHSA-h4r5-mxv5-8mjc
• https://github.com/getkin/kin-openapi/security/advisories/GHSA-h4r5-mxv5-8mjc

Published

Oct 15, 2026

Last Modified

Oct 15, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-10033The EventON Action User plugin for WordPress is vulnerable t…7.3
• CVE-2026-10034The WP DSGVO Tools (GDPR) plugin for WordPress is vulnerable…5.3
• CVE-2026-100347kin-openapi is a Go project for handling OpenAPI files. Prio…5.3
• CVE-2026-100348kin-openapi is a Go project for handling OpenAPI files. Prio…5.3
• CVE-2026-100349kin-openapi is a Go project for handling OpenAPI files. Prio…8.2
• CVE-2026-10035The Turnkey bbPress by WeaverTheme plugin for WordPress is v…6.6
• CVE-2026-100351kin-openapi is a Go project for handling OpenAPI files. From…7.4
• CVE-2026-100352kin-openapi is a Go project for handling OpenAPI files. Prio…7.5
• CVE-2026-100353kin-openapi is a Go project for handling OpenAPI files. From…7.5
• CVE-2026-100354kin-openapi is a Go project for handling OpenAPI files. Prio…7.5
• CVE-2026-100355Campfire is a web-based chat application. In version 1.4.4 a…3.1
• CVE-2026-10036SpeechBrain before 1.1.1 contains an arbitrary code executio…8.8