Is CVE-2026-100348 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-100348 being exploited in the wild.

How severe is CVE-2026-100348?

Medium severity, with a CVSS score of 5.3, published 15 October 2026.

Which products and versions are affected?

github.com/getkin/kin-openapi (Go) <= 0.144.0, SEMVER:introduced=0,fixed=0.145.0; Kin-Openapi up to v0.144.0.

How is CVE-2026-100348 attacked?

It is attacked over the network.

Am I affected by CVE-2026-100348?

Check whether you run github.com/getkin/kin-openapi (Go) or Kin-Openapi at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100348: kin-openapi OpenAPI spec loader nil-pointer panic on self-referential additionalProperties

Q: Is there a fix for CVE-2026-100348?

Yes. github.com/getkin/kin-openapi (Go): upgrade to 0.145.0 or later. Until then: Restrict the loading of untrusted OpenAPI specifications, or run the loader in a sandboxed environment with crash recovery. Alternatively, validate specs through an intermediate safe parser before passing to kin-openapi's loader. [{"kind": "disclosed", "at": "2026-10-15"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

CVE-2026-100348 · Severity: medium · CVSS 5.3 · Published 2026-10-15

kin-openapi is a Go library for parsing and validating OpenAPI specifications. A maliciously crafted OpenAPI document can crash the loader during spec parsing, causing a denial of service in any tool or service that ingests untrusted specs—such as API registries, management platforms, linters, or converters.

Technologies: github.com/getkin/kin-openapi (Go). Vendors: Go.

Quick answers

Is CVE-2026-100348 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-100348 being exploited in the wild.
How severe is CVE-2026-100348?: Medium severity, with a CVSS score of 5.3, published 15 October 2026.
Which products and versions are affected?: github.com/getkin/kin-openapi (Go) <= 0.144.0, SEMVER:introduced=0,fixed=0.145.0; Kin-Openapi up to v0.144.0.
Is there a fix for CVE-2026-100348?: Yes. github.com/getkin/kin-openapi (Go): upgrade to 0.145.0 or later. Until then: Restrict the loading of untrusted OpenAPI specifications, or run the loader in a sandboxed environment with crash recovery. Alternatively, validate specs through an intermediate safe parser before passing to kin-openapi's loader.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-15"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-100348 attacked?: It is attacked over the network.
Am I affected by CVE-2026-100348?: Check whether you run github.com/getkin/kin-openapi (Go) or Kin-Openapi at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/getkin/kin-openapi (Go): upgrade to 0.145.0 or later
```
go get github.com/getkin/kin-openapi@v0.145.0
```

Restrict the loading of untrusted OpenAPI specifications, or run the loader in a sandboxed environment with crash recovery. Alternatively, validate specs through an intermediate safe parser before passing to kin-openapi's loader.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-15"}]

Technical details

The vulnerability is a nil-pointer dereference in the loader's resolveComponent function (openapi3/loader.go line 455) when processing a schema with a self-referential $ref that targets the schema's own additionalProperties field. The code dereferences c.Value.AdditionalProperties without checking whether c.Value is nil, which occurs when a $ref fragment drills through additionalProperties of a not-yet-resolved schema. This triggers a panic during LoadFromData/LoadFromFile/LoadFromURI before validation occurs, with no recovery handler in the loader.

Affected products

kin-openapi kin-openapi up to v0.144.0

Identifiers

CVE-2026-100348
GHSA-mh7x-f8wq-4jhx
GO-2026-6789

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.