CVE-2026-100352

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.148.0, the OpenAPI 3.1 validation path passes YAML NaN and infinity numeric values to santhosh-tekuri/jsonschema v6.0.2 without applying kin-openapi's existing finite-number guards. A remote unauthenticated client can send an application/yaml or application/x-yaml request body containing .nan, .inf, or -.inf to an operation with a numeric constraint, causing the dependency to create and dereference a nil big.Rat during ValidateRequest. Standard net/http servers recover the panic per connection, while other hosts or application goroutines may terminate the process. This issue is fixed in version 0.148.0.

• CWE-754

• https://github.com/getkin/kin-openapi/commit/4487f198ab8be0c37d6ca72c54f5dca4dc25270e
• https://github.com/getkin/kin-openapi/releases/tag/v0.148.0
• https://github.com/getkin/kin-openapi/security/advisories/GHSA-rj39-cv6w-8wv7
• https://github.com/getkin/kin-openapi/security/advisories/GHSA-rj39-cv6w-8wv7

Published

Oct 15, 2026

Last Modified

Oct 20, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-100347kin-openapi is a Go project for handling OpenAPI files. Prio…5.3
• CVE-2026-100348kin-openapi is a Go project for handling OpenAPI files. Prio…5.3
• CVE-2026-100349kin-openapi is a Go project for handling OpenAPI files. Prio…8.2
• CVE-2026-10035The Turnkey bbPress by WeaverTheme plugin for WordPress is v…6.6
• CVE-2026-100350kin-openapi is a Go project for handling OpenAPI files. From…5.3
• CVE-2026-100351kin-openapi is a Go project for handling OpenAPI files. From…7.4
• CVE-2026-100353kin-openapi is a Go project for handling OpenAPI files. From…7.5
• CVE-2026-100354kin-openapi is a Go project for handling OpenAPI files. Prio…7.5
• CVE-2026-100355Campfire is a web-based chat application. In version 1.4.4 a…3.1
• CVE-2026-100358SuiteCRM is an open-source, enterprise-ready Customer Relati…9.4
• CVE-2026-100359SuiteCRM is an open-source, enterprise-ready Customer Relati…6.5
• CVE-2026-10036SpeechBrain before 1.1.1 contains an arbitrary code executio…8.8