Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/getkin/kin-openapi

14 known vulnerabilities (1 critical, 9 high, 4 medium), with the versions each affects and the releases that fix them.

Latest release
v0.153.0 (Nov 7, 2026): no advisory affects it
Newest unaffected release
v0.153.0 (Nov 7, 2026), the latest release
Advisories
14 · 1 critical, 9 high, 4 medium
Releases
157 since v0.1.0 (Sep 29, 2018)
Registry
pkg.go.dev
Releases read
Nov 8, 2026

Version timeline

Show all 14 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 14

  • kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter

    Affected: from 0.136.0, fixed in 0.149.0.

    Fixed in v0.149.0 (released Aug 28, 2026, 48 days before disclosure).

    The latest release, v0.153.0, is not affected.

  • kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crash

    Affected: fixed in 0.149.0.

    Fixed in v0.149.0 (released Aug 28, 2026, 48 days before disclosure).

    The latest release, v0.153.0, is not affected.

  • kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path

    Affected: fixed in 0.148.0.

    Fixed in v0.148.0 (released Aug 27, 2026, 49 days before disclosure).

    The latest release, v0.153.0, is not affected.

  • kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion

    Affected: from 0.144.0, fixed in 0.147.0.

    Fixed in v0.147.0 (released Aug 18, 2026, 58 days before disclosure).

    The latest release, v0.153.0, is not affected.

  • kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content

    Affected: fixed in 0.146.0.

    Fixed in v0.146.0 (released Aug 3, 2026, 73 days before disclosure).

    The latest release, v0.153.0, is not affected.

  • CVE-2026-100350Medium 5.3

    kin-openapi deepObject query decoding repeatedly compiles an invariant regular expression

    Affected: from 0.145.0, fixed in 0.146.0.

    Fixed in v0.146.0 (released Aug 3, 2026, 73 days before disclosure).

    The latest release, v0.153.0, is not affected.

  • CVE-2026-100347Medium 5.3

    kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static path

    Affected: fixed in 0.145.0.

    Fixed in v0.145.0 (released Jul 25, 2026, 82 days before disclosure).

    The latest release, v0.153.0, is not affected.

  • CVE-2026-100348Medium 5.3

    kin-openapi spec loader panics on a self-referential additionalProperties $ref (nil-pointer DoS)

    Affected: fixed in 0.145.0.

    Fixed in v0.145.0 (released Jul 25, 2026, 82 days before disclosure).

    The latest release, v0.153.0, is not affected.

  • kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing items

    Affected: from 0.136.0, fixed in 0.143.0.

    Fixed in v0.143.0 (released Jul 21, 2026, 86 days before disclosure).

    The latest release, v0.153.0, is not affected.

  • kin-openapi: Uncontrolled resource consumption in openapi3filter deepObject query parameter decoding

    Affected: from 0.124.0, fixed in 0.142.0.

    Fixed in v0.142.0 (released Jul 11, 2026, 41 days before disclosure).

    The latest release, v0.153.0, is not affected.

  • kin-openapi openai3filter: nil-pointer panic in ConvertErrors on malformed multipart/form-data body enables unauthenticated DoS

    Affected: from 0.10.0, fixed in 0.141.0.

    Fixed in v0.141.0 (released Jul 10, 2026, 42 days before disclosure).

    The latest release, v0.153.0, is not affected.

  • CVE-2026-73502Medium 5.3

    kin-openapi openapi3filter: unauthenticated nil-pointer panic when validating a request against a `content` parameter whose media type has…

    Affected: fixed in 0.144.0.

    Fixed in v0.144.0 (released Jul 23, 2026, 26 days before disclosure).

    The latest release, v0.153.0, is not affected.

  • CVE-2026-73501Critical 9.1

    kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default

    Affected: fixed in 0.144.0.

    Fixed in v0.144.0 (released Jul 23, 2026, 20 days before disclosure).

    The latest release, v0.153.0, is not affected.

  • Improper Handling of Highly Compressed Data (Data Amplification) in github.com/getkin/kin-openapi/openapi3filter

    Affected: fixed in 0.131.0.

    Fixed in v0.131.0 (released Mar 19, 2025, the day of disclosure).

    The latest release, v0.153.0, is not affected.