Is CVE-2026-100352 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-100352 being exploited in the wild.

How severe is CVE-2026-100352?

High severity, with a CVSS score of 7.5, published 15 October 2026.

Which products and versions are affected?

Getkin Kin-Openapi before 0.144.1; github.com/getkin/kin-openapi (Go) < 0.148.0, SEMVER:introduced=0,fixed=0.148.0.

How is CVE-2026-100352 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-100352?

Check whether you run Getkin Kin-Openapi or github.com/getkin/kin-openapi (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100352: kin-openapi NaN/Inf values bypass validation and cause panic in OAS 3.1

Q: Is there a fix for CVE-2026-100352?

Yes. github.com/getkin/kin-openapi (Go): upgrade to 0.148.0 or later. Until then: Restrict request Content-Type headers to exclude `application/yaml` and `application/x-yaml` if YAML parsing is not required, or upgrade the transitive dependency santhosh-tekuri/jsonschema/v6 to v6.0.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-100352 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-100352?

Check whether you run Getkin Kin-Openapi or github.com/getkin/kin-openapi (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100352 · Severity: high · CVSS 7.5 · Published 2026-10-15

kin-openapi is a library that validates HTTP requests and responses against OpenAPI specifications. When processing OpenAPI 3.1 specs with numeric constraints, the library fails to reject NaN and Inf values in YAML request bodies, causing the Go runtime to panic. An attacker can send a single malicious YAML request to trigger a denial-of-service condition affecting either the current connection or the entire service process.

Technologies: Getkin Kin-Openapi, github.com/getkin/kin-openapi (Go). Vendors: Getkin, Go.

Quick answers

Is CVE-2026-100352 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-100352 being exploited in the wild.
How severe is CVE-2026-100352?: High severity, with a CVSS score of 7.5, published 15 October 2026.
Which products and versions are affected?: Getkin Kin-Openapi before 0.144.1; github.com/getkin/kin-openapi (Go) < 0.148.0, SEMVER:introduced=0,fixed=0.148.0.
Is there a fix for CVE-2026-100352?: Yes. github.com/getkin/kin-openapi (Go): upgrade to 0.148.0 or later. Until then: Restrict request Content-Type headers to exclude `application/yaml` and `application/x-yaml` if YAML parsing is not required, or upgrade the transitive dependency santhosh-tekuri/jsonschema/v6 to v6.0.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-100352 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-100352?: Check whether you run Getkin Kin-Openapi or github.com/getkin/kin-openapi (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/getkin/kin-openapi (Go): upgrade to 0.148.0 or later
```
go get github.com/getkin/kin-openapi@v0.148.0
```

Restrict request Content-Type headers to exclude `application/yaml` and `application/x-yaml` if YAML parsing is not required, or upgrade the transitive dependency santhosh-tekuri/jsonschema/v6 to v6.0.3 or later.

Technical details

The vulnerability occurs when OpenAPI 3.1 specifications dispatch validation through `useJSONSchema2020`, which hands numeric values directly to the upstream `jsonschema/v6` library without guarding against NaN/Inf. The upstream library attempts to build a `big.Rat` from these special float values, which silently returns nil, and then dereferences the nil pointer in the `Cmp` method. An attacker triggers this by sending an HTTP request with `Content-Type: application/yaml` containing YAML tokens `.nan`, `.inf`, or `-.inf` in a schema with numeric constraints (`minimum`, `maximum`, `exclusiveMinimum`, `exclusiveMaximum`, `multipleOf`).

Affected products

getkin kin-openapi before 0.144.1

Identifiers

CVE-2026-100352
GHSA-rj39-cv6w-8wv7
GO-2026-6795

Timeline

2026-10-15: disclosed: GHSA-rj39-cv6w-8wv7 published

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.