Skip to content
OpenAdvisories
High · 7.5 CVE-2026-97394 EUVD-2026-102143GHSA-p6wj-qrr4-pgh5GO-2026-6790

kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing items

Published Oct 15, 2026 · Updated Oct 20, 2026 · Assigned by GitHub_M

Description

kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.143.0, openapi3filter accepts OpenAPI 3.1 array schemas without an items keyword and then dereferences the nil Schema.Items value while decoding application/x-www-form-urlencoded or multipart/form-data request bodies, response headers, and other array parameter surfaces. A remote unauthenticated client can reach an affected operation with a nonempty request or matching response and deterministically trigger a nil-pointer panic during ValidateRequest or ValidateResponse. OpenAPI 3.0 documents are not affected because document validation rejects arrays without items, and JSON request bodies use a different decoder path. This issue is fixed in version 0.143.0.

Affected products

VendorProductAffectedFixed
getkin kin-openapi >= 0.136.0, < 0.143.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Ubuntu 26.10 golang-github-getkin-kin-openapi No fix yet —
Ubuntu 26.04 LTS golang-github-getkin-kin-openapi No fix yet —
Ubuntu 24.04 LTS golang-github-getkin-kin-openapi No fix yet —
Ubuntu 22.04 LTS golang-github-getkin-kin-openapi No fix yet —
ReleasePackageFixed inAdvisory
Red Hat Hardened Images 1 grafana12.4 12.4.12-0.4.hum1 RHSA-2026:76677
Red Hat Hardened Images 1 grafana13.1 13.1.7-0.1.hum1 RHSA-2026:76448
Red Hat Hardened Images 1 grafana13.2 13.2.3-0.1.hum1 RHSA-2026:76430
Red Hat Hardened Images 1 hugo 0.168.0-0.1.hum1 RHSA-2026:82637

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/getkin/kin-openapi >= 0.136.0, < 0.143.0 0.143.0 GHSA-p6wj-qrr4-pgh5

Advisories 4

References