Most recent entries from all

fkie_cve-2026-100352

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.148.0, the OpenAPI 3.1 validation path passes YAML NaN and infinity numeric values to santhosh-tekuri/jsonschema v6.0.2 without applying kin-openapi's existing finite-number guards. A remote unauthenticated client can send an application/yaml or application/x-yaml request body containing .nan, .inf, or -.inf to an operation with a numeric constraint, causing the dependency to create and dereference a nil big.Rat during ValidateRequest. Standard net/http servers recover the panic per connection, while other hosts or application goroutines may terminate the process. This issue is fixed in version 0.148.0.

GHSA-rj39-cv6w-8wv7 — kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path

Affected: Go: github.com/getkin/kin-openapi

## Summary

kin-openapi guards against `NaN` and `Inf` values in its built-in schema visitor (`visitJSON`) by returning `ErrSchemaInputNaN` / `ErrSchemaInputInf` when a `float64` input violates those constraints. For OAS 3.1 specs, however, `Schema.VisitJSON` routes through `useJSONSchema2020`, which hands the value directly to `santhosh-tekuri/jsonschema/v6` v6.0.2 without applying the same guard.

Inside `jsonschema/v6` v6.0.2, `numValidate` builds a `*big.Rat` from the input via `big.Rat.SetString(fmt.Sprintf("%v", v))`. For `NaN`/`Inf` this parse fails silently and returns `nil`. `numValidate` then dereferences the nil `*big.Rat` (in `math/big.(*Rat).Cmp`), producing a Go runtime panic.

An attacker delivers this by sending an HTTP request with `Content-Type: application/yaml` (or `application/x-yaml`) and a YAML body containing `.nan`, `.inf`, or `-.inf`. The `YamlBodyDecoder` decodes those tokens into `math.NaN()` / `math.Inf(±1)` (standard YAML 1.2 behavior), and they propagate to the unguarded `useJSONSchema2020` path whenever the schema declares a numeric constraint (`minimum`, `maximum`, `exclusiveMinimum`, `exclusiveMaximum`, or `multipleOf`).

## Details ### Root Cause

The built-in visitor `visitJSON` at `openapi3/schema.go:1968` guards NaN/Inf explicitly:

```go case float64: if math.IsNaN(value) { return ErrSchemaInputNaN } if math.IsInf(value, 0) { return ErrSchemaInputInf } ```

For OAS 3.1 specs, `VisitJSON` dispatches to `us…

RHSA-2026:82637 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

github.com/getkin/kin-openapi: kin-openapi: Denial of Service via nil-pointer dereference in openapi3filter github.com/getkin/kin-openapi: kin-openapi: Denial of Service via unsupported HTTP methods on static paths github.com/getkin/kin-openapi: kin-openapi: Denial of Service via nil pointer dereference in response validation github.com/getkin/kin-openapi: kin-openapi: Denial of Service via redundant regular expression compilation in query parameter decoding github.com/getkin/kin-openapi: kin-openapi: Authentication bypass via URL path decoding discrepancy github.com/getkin/kin-openapi: kin-openapi: Denial of Service via improper handling of non-finite numeric values github.com/getkin/kin-openapi: kin-openapi: Denial of Service via nil-pointer dereference in request decoding github.com/getkin/kin-openapi: kin-openapi: Denial of Service via unbounded recursion during schema validation