Hi,
The following vulnerabilities were published for golang-github-getkin-kin-openapi.
CVE-2026-100347[0]:
| kin-openapi is a Go project for handling OpenAPI files. Prior to
| 0.145.0, openapi3filter.ValidationHandler uses the routers/legacy
| router, which passes an unsupported or non-canonical HTTP method for
| an existing static path to openapi3.PathItem.GetOperation. The
| default branch of GetOperation panics before authentication runs, so
| an unauthenticated remote client can repeatedly send methods such as
| PROPFIND or lowercase get to abort connections and generate stack-
| trace log growth. The specific panic requires an exact static path;
| a concrete path matched only by a templated route does not reach the
| same sink. This issue is fixed in version 0.145.0.
CVE-2026-100348[1]:
| kin-openapi is a Go project for handling OpenAPI files. Prior to
| 0.145.0, openapi3.Loader can dereference a nil SchemaRef.Value while
| resolving a self-referential additionalProperties JSON Reference
| such as a schema that points to its own additionalProperties member.
| Loading an attacker-controlled OpenAPI document through
| LoadFromData, LoadFromFile, or LoadFromURI reaches resolveComponent
| before document validation and can panic the loading process.
| Resolved additionalProperties schemas and ordinary recursive schemas
| do not take the vulnerable nil-value path. This issue is fixed in
| version 0.145.0.
CVE-2026-100349[2]:
| kin-openapi is a Go project for handling OpenAPI files. Prior to
| 0.146.0, openapi3filter.ValidateResponse passes a nil response
| header schema to decodeValue when an OpenAPI document declares the
| header with content instead of schema. The document passes
| validation, but every response validation for the affected operation
| dereferences the nil schema and panics even when the response does
| not contain the declared header. Applications that ingest an
| untrusted specification can expose this as remote availability
| impact, while applications using only trusted local specifications
| still crash when the affected operation is exercised. This issue is
| fixed in version 0.146.0.
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-100347
https://www.cve.org/CVERecord?id=CVE-2026-100347
[1] https://security-tracker.debian.org/tracker/CVE-2026-100348
https://www.cve.org/CVERecord?id=CVE-2026-100348
[2] https://security-tracker.debian.org/tracker/CVE-2026-100349
https://www.cve.org/CVERecord?id=CVE-2026-100349
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore