kin-openapi CVE-2026-100352 Patched in 0.148.0 to Fix YAML NaN Panic
A high-severity flaw in the Go library allows crafted YAML inputs to trigger a runtime panic via unguarded numeric validation.
Key points
- CVE-2026-100352 affects kin-openapi versions prior to 0.148.0
- The issue stems from missing guards in the OAS 3.1 JSON Schema validation path
- Patched version 0.148.0 is available to resolve the runtime panic risk
The Go library kin-openapi has released version 0.148.0 to address a high-severity vulnerability identified as CVE-2026-100352. This update resolves a flaw where specific YAML inputs could cause a runtime panic in applications using OpenAPI Specification 3.1 schemas.
What happened
The vulnerability exists in how kin-openapi handles numeric validation for OpenAPI Specification 3.1 documents. While the library’s built-in schema visitor guards against Not-a-Number and Infinity values, the path used for OAS 3.1 specs does not apply the same checks. According to the GitHub advisory, this route hands values directly to the jsonschema/v6 library without filtering.
When an attacker sends a YAML body containing `.nan`, `.inf`, or `-.inf`, the decoder converts these tokens into Go’s math representations. These values then propagate to the unguarded validation path whenever the schema declares numeric constraints like minimum or maximum. The downstream library attempts to parse these values, fails silently, and returns a nil pointer.
Subsequent dereferencing of this nil pointer triggers a Go runtime panic. This occurs specifically when the input violates constraints such as exclusiveMinimum or multipleOf. The panic results in a crash for the affected application. The fix in version 0.148.0 is available to address this issue.
Why it matters
This issue impacts any service using kin-openapi versions older than 0.148.0 to validate API requests. Because the trigger relies on standard YAML 1.2 behavior, attackers can easily craft payloads using common HTTP clients. The vulnerability is rated high severity according to the GitHub advisory.
Teams relying on OAS 3.1 specifications are particularly exposed. The default validation path for these specs bypasses the safety checks present in earlier schema versions. This creates an inconsistent security posture where similar inputs are handled differently based on the specification version used. Updating to the patched version restores consistent input validation across all supported schema types.
What to watch
- Monitor for sudden application crashes or panics in logs following API requests
- Check if your services accept YAML content types with numeric schema constraints
- Verify that your dependency manager pulls version 0.148.0 or later
- Review input validation logic for other libraries handling float64 values
Who needs to act first
Teams should prioritize updating systems that expose public-facing APIs accepting YAML payloads. Focus on services that enforce strict numeric constraints in their OpenAPI schemas, as these are most likely to trigger the panic. Before rolling out the update, test the new library version in a staging environment to ensure compatibility with existing validation rules. Back up configuration files and application states to allow for quick rollback if integration issues arise.
Background: APIs
APIs in healthcare allow different software systems to exchange patient data automatically. They streamline care coordination but introduce significant security risks if access controls are weak. You must enforce strict authentication, limit data exposure, and monitor traffic patterns to prevent unauthorized access or data leaks in these critical integrations.
Read the full guide: APIs in Healthcare: Secure Data Exchange Without Breaches
What to do and how to stay safe: kin-openapi
- Update kin-openapi to version 0.148.0 or later in all affected Go projects
- Scan your codebase for imports of older kin-openapi versions using dependency tools
- Implement input sanitization for YAML bodies to reject non-standard numeric tokens
- Enable detailed logging for API validation errors to detect potential abuse attempts
Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks
General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVE ID for this kin-openapi vulnerability?
The vulnerability is identified as CVE-2026-100352.
Which versions of kin-openapi are affected?
All versions prior to 0.148.0 are vulnerable to this issue.
Is there a patch available for CVE-2026-100352?
Yes, version 0.148.0 contains the fix for this vulnerability.
