What’s Vulnerable › Products
getkin kin-openapi vulnerabilities
14 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 14 published in the last 12 months.
Check whether your getkin kin-openapi version is affected
Latest getkin kin-openapi vulnerabilities
- CVE-2026-100354 — kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crash (CVSS 7.5)
- CVE-2026-100353 — kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter (CVSS 7.5)
- CVE-2026-97394 — kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing items (CVSS 7.5)
- CVE-2026-100352 — kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path (CVSS 7.5)
- CVE-2026-100351 — kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion (CVSS 7.4)
- CVE-2026-100350 — kin-openapi deepObject query decoding repeatedly compiles an invariant regular expression (CVSS 5.3)
- CVE-2026-100349 — kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content (CVSS 8.2)
- CVE-2026-100348 — kin-openapi spec loader panics on a self-referential additionalProperties $ref (nil-pointer DoS) (CVSS 5.3)
- CVE-2026-100347 — kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static path (CVSS 5.3)
- CVE-2026-77354 — kin-openapi: Uncontrolled resource consumption in openapi3filter deepObject query parameter decoding (CVSS 8.7)
- CVE-2026-76905 — kin-openapi openai3filter: nil-pointer panic in ConvertErrors on malformed multipart/form-data body enables unauthenticated DoS (CVSS 7.5)
- CVE-2026-73502 — kin-openapi openapi3filter: unauthenticated nil-pointer panic when validating a request against a `content` parameter whose media type has no schema (CVSS 5.3)
- CVE-2026-73501 — kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default (CVSS 9.1)
- CVE-2025-30153 — Improper Handling of Highly Compressed Data (Data Amplification) in github.com/getkin/kin-openapi/openapi3filter (CVSS 7.5)