Is CVE-2026-100350 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-100350 being exploited in the wild.

How severe is CVE-2026-100350?

Medium severity, with a CVSS score of 5.3, published 15 October 2026.

Which products and versions are affected?

Getkin Kin-Openapi unfixed versions prior to fix; github.com/getkin/kin-openapi (Go) >= 0.145.0, < 0.146.0, SEMVER:introduced=0.145.0,fixed=0.146.0.

How is CVE-2026-100350 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-100350?

Check whether you run Getkin Kin-Openapi or github.com/getkin/kin-openapi (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100350: kin-openapi deepObject query decoding DoS via repeated regexp compilation

Q: Is there a fix for CVE-2026-100350?

Yes. github.com/getkin/kin-openapi (Go): upgrade to 0.146.0 or later. Until then: Implement request or URL size limits and query-key count restrictions at a reverse proxy, load balancer, or middleware layer to bound the number of loop iterations an attacker can force per request. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-100350 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-100350?

Check whether you run Getkin Kin-Openapi or github.com/getkin/kin-openapi (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100350 · Severity: medium · CVSS 5.3 · Published 2026-10-15

kin-openapi's openapi3filter library validates incoming API requests against OpenAPI specifications. When validating requests with deepObject-style query parameters, a regular expression pattern is recompiled for every query key present in the request, even though the pattern never changes. An attacker can send a request with thousands of junk query parameters to force proportional CPU consumption, allowing them to exhaust server resources and deny service to legitimate users.

Technologies: Getkin Kin-Openapi, github.com/getkin/kin-openapi (Go). Vendors: Getkin, Go.

Quick answers

Is CVE-2026-100350 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-100350 being exploited in the wild.
How severe is CVE-2026-100350?: Medium severity, with a CVSS score of 5.3, published 15 October 2026.
Which products and versions are affected?: Getkin Kin-Openapi unfixed versions prior to fix; github.com/getkin/kin-openapi (Go) >= 0.145.0, < 0.146.0, SEMVER:introduced=0.145.0,fixed=0.146.0.
Is there a fix for CVE-2026-100350?: Yes. github.com/getkin/kin-openapi (Go): upgrade to 0.146.0 or later. Until then: Implement request or URL size limits and query-key count restrictions at a reverse proxy, load balancer, or middleware layer to bound the number of loop iterations an attacker can force per request. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-100350 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-100350?: Check whether you run Getkin Kin-Openapi or github.com/getkin/kin-openapi (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/getkin/kin-openapi (Go): upgrade to 0.146.0 or later
```
go get github.com/getkin/kin-openapi@v0.146.0
```

Implement request or URL size limits and query-key count restrictions at a reverse proxy, load balancer, or middleware layer to bound the number of loop iterations an attacker can force per request.

Technical details

The vulnerability exists in openapi3filter's deepObject query parameter decoding, which recompiles a loop-invariant regular expression (matching `^<param>\[`) once per query key in the request instead of once per parameter. Since the number of query keys is attacker-controlled and unbounded, this scales CPU consumption linearly with the request's query-key count and the number of deepObject parameters on the endpoint. The issue affects ValidateRequest calls on any endpoint with at least one `in: query`, `style: deepObject` parameter.

Affected products

getkin kin-openapi unfixed versions prior to fix

Identifiers

CVE-2026-100350
GHSA-h4r5-mxv5-8mjc
GO-2026-6787

Timeline

2026-10-15: disclosed
2026-10-15: advisory: GHSA-h4r5-mxv5-8mjc

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.