# github.com/getkin/kin-openapi (Go) vulnerabilities 14 known vulnerabilities (1 critical, 9 high, 4 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: v0.153.0 (Nov 7, 2026): no advisory affects it - Newest unaffected release: v0.153.0 (Nov 7, 2026), the latest release - Releases: 157 since v0.1.0 (Sep 29, 2018) - Registry: https://pkg.go.dev/github.com/getkin/kin-openapi - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-100353: v0.136.0 to v0.148.0 (v0.149.0 is outside it) - CVE-2026-100354: v0.1.0 to v0.148.0 (v0.149.0 is outside it) - CVE-2026-100352: v0.1.0 to v0.147.0 (v0.148.0 is outside it) - CVE-2026-100351: v0.144.0 to v0.146.0 (v0.147.0 is outside it) - CVE-2026-100349: v0.1.0 to v0.145.0 (v0.146.0 is outside it) - CVE-2026-100350: v0.145.0 (v0.146.0 is outside it) - CVE-2026-100347: v0.1.0 to v0.144.0 (v0.145.0 is outside it) - CVE-2026-100348: v0.1.0 to v0.144.0 (v0.145.0 is outside it) - CVE-2026-97394: v0.136.0 to v0.142.0 (v0.143.0 is outside it) - CVE-2026-77354: v0.124.0 to v0.141.0 (v0.142.0 is outside it) - CVE-2026-76905: v0.10.0 to v0.140.0 (v0.141.0 is outside it) - CVE-2026-73502: v0.1.0 to v0.143.0 (v0.144.0 is outside it) - CVE-2026-73501: v0.1.0 to v0.143.0 (v0.144.0 is outside it) - CVE-2025-30153: v0.1.0 to v0.130.0 (v0.131.0 is outside it) ## Advisories (14) ### [CVE-2026-100353](https://cve.now/CVE-2026-100353): kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter - Severity: High 7.5 - Published: Oct 15, 2026 - Affected: from 0.136.0, fixed in 0.149.0. - Fixed in v0.149.0 (released Aug 28, 2026, 48 days before disclosure). - The latest release, v0.153.0, is not affected. ### [CVE-2026-100354](https://cve.now/CVE-2026-100354): kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crash - Severity: High 7.5 - Published: Oct 15, 2026 - Affected: fixed in 0.149.0. - Fixed in v0.149.0 (released Aug 28, 2026, 48 days before disclosure). - The latest release, v0.153.0, is not affected. ### [CVE-2026-100352](https://cve.now/CVE-2026-100352): kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path - Severity: High 7.5 - Published: Oct 15, 2026 - Affected: fixed in 0.148.0. - Fixed in v0.148.0 (released Aug 27, 2026, 49 days before disclosure). - The latest release, v0.153.0, is not affected. ### [CVE-2026-100351](https://cve.now/CVE-2026-100351): kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion - Severity: High 7.4 - Published: Oct 15, 2026 - Affected: from 0.144.0, fixed in 0.147.0. - Fixed in v0.147.0 (released Aug 18, 2026, 58 days before disclosure). - The latest release, v0.153.0, is not affected. ### [CVE-2026-100349](https://cve.now/CVE-2026-100349): kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content - Severity: High 8.2 - Published: Oct 15, 2026 - Affected: fixed in 0.146.0. - Fixed in v0.146.0 (released Aug 3, 2026, 73 days before disclosure). - The latest release, v0.153.0, is not affected. ### [CVE-2026-100350](https://cve.now/CVE-2026-100350): kin-openapi deepObject query decoding repeatedly compiles an invariant regular expression - Severity: Medium 5.3 - Published: Oct 15, 2026 - Affected: from 0.145.0, fixed in 0.146.0. - Fixed in v0.146.0 (released Aug 3, 2026, 73 days before disclosure). - The latest release, v0.153.0, is not affected. ### [CVE-2026-100347](https://cve.now/CVE-2026-100347): kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static path - Severity: Medium 5.3 - Published: Oct 15, 2026 - Affected: fixed in 0.145.0. - Fixed in v0.145.0 (released Jul 25, 2026, 82 days before disclosure). - The latest release, v0.153.0, is not affected. ### [CVE-2026-100348](https://cve.now/CVE-2026-100348): kin-openapi spec loader panics on a self-referential additionalProperties $ref (nil-pointer DoS) - Severity: Medium 5.3 - Published: Oct 15, 2026 - Affected: fixed in 0.145.0. - Fixed in v0.145.0 (released Jul 25, 2026, 82 days before disclosure). - The latest release, v0.153.0, is not affected. ### [CVE-2026-97394](https://cve.now/CVE-2026-97394): kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing items - Severity: High 7.5 - Published: Oct 15, 2026 - Affected: from 0.136.0, fixed in 0.143.0. - Fixed in v0.143.0 (released Jul 21, 2026, 86 days before disclosure). - The latest release, v0.153.0, is not affected. ### [CVE-2026-77354](https://cve.now/CVE-2026-77354): kin-openapi: Uncontrolled resource consumption in openapi3filter deepObject query parameter decoding - Severity: High 8.7 - Published: Aug 21, 2026 - Affected: from 0.124.0, fixed in 0.142.0. - Fixed in v0.142.0 (released Jul 11, 2026, 41 days before disclosure). - The latest release, v0.153.0, is not affected. ### [CVE-2026-76905](https://cve.now/CVE-2026-76905): kin-openapi openai3filter: nil-pointer panic in ConvertErrors on malformed multipart/form-data body enables unauthenticated DoS - Severity: High 7.5 - Published: Aug 21, 2026 - Affected: from 0.10.0, fixed in 0.141.0. - Fixed in v0.141.0 (released Jul 10, 2026, 42 days before disclosure). - The latest release, v0.153.0, is not affected. ### [CVE-2026-73502](https://cve.now/CVE-2026-73502): kin-openapi openapi3filter: unauthenticated nil-pointer panic when validating a request against a \`content\` parameter whose media type has… - Severity: Medium 5.3 - Published: Aug 18, 2026 - Affected: fixed in 0.144.0. - Fixed in v0.144.0 (released Jul 23, 2026, 26 days before disclosure). - The latest release, v0.153.0, is not affected. ### [CVE-2026-73501](https://cve.now/CVE-2026-73501): kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default - Severity: Critical 9.1 - Published: Aug 12, 2026 - Affected: fixed in 0.144.0. - Fixed in v0.144.0 (released Jul 23, 2026, 20 days before disclosure). - The latest release, v0.153.0, is not affected. ### [CVE-2025-30153](https://cve.now/CVE-2025-30153): Improper Handling of Highly Compressed Data (Data Amplification) in github.com/getkin/kin-openapi/openapi3filter - Severity: High 7.5 - Published: Mar 19, 2025 - Affected: fixed in 0.131.0. - Fixed in v0.131.0 (released Mar 19, 2025, the day of disclosure). - The latest release, v0.153.0, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/go/github.com/getkin/kin-openapi Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.