# CVE-2026-100352: kin-openapi NaN/Inf values bypass validation and cause panic in OAS 3.1

Source: https://junglewise.ai/threats/cve-2026-100352-kin-openapi-yaml-nan-inf-values-bypass-built-in-guards-and-panic  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-15. Updated: 2026-10-15  
License: CC BY 4.0 with a link back

CVE-2026-100352 · Severity: high · CVSS 7.5 · Published 2026-10-15

kin-openapi is a library that validates HTTP requests and responses against OpenAPI specifications. When processing OpenAPI 3.1 specs with numeric constraints, the library fails to reject NaN and Inf values in YAML request bodies, causing the Go runtime to panic. An attacker can send a single malicious YAML request to trigger a denial-of-service condition affecting either the current connection or the entire service process.

Technologies: [Getkin Kin-Openapi](https://junglewise.ai/threats/technologies/kin-openapi), [github.com/getkin/kin-openapi (Go)](https://junglewise.ai/threats/technologies/github-com-getkin-kin-openapi). Vendors: [Getkin](https://junglewise.ai/threats/vendors/getkin), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-100352 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-100352 being exploited in the wild.

**How severe is CVE-2026-100352?** High severity, with a CVSS score of 7.5, published 15 October 2026.

**Which products and versions are affected?** Getkin Kin-Openapi before 0.144.1; github.com/getkin/kin-openapi (Go) < 0.148.0, SEMVER:introduced=0,fixed=0.148.0.

**Is there a fix for CVE-2026-100352?** Yes. github.com/getkin/kin-openapi (Go): upgrade to 0.148.0 or later. Until then: Restrict request Content-Type headers to exclude `application/yaml` and `application/x-yaml` if YAML parsing is not required, or upgrade the transitive dependency santhosh-tekuri/jsonschema/v6 to v6.0.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-100352 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-100352?** Check whether you run Getkin Kin-Openapi or github.com/getkin/kin-openapi (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/getkin/kin-openapi (Go): upgrade to 0.148.0 or later

  ```sh
  go get github.com/getkin/kin-openapi@v0.148.0
  ```


Restrict request Content-Type headers to exclude `application/yaml` and `application/x-yaml` if YAML parsing is not required, or upgrade the transitive dependency santhosh-tekuri/jsonschema/v6 to v6.0.3 or later.

## Technical details

The vulnerability occurs when OpenAPI 3.1 specifications dispatch validation through `useJSONSchema2020`, which hands numeric values directly to the upstream `jsonschema/v6` library without guarding against NaN/Inf. The upstream library attempts to build a `big.Rat` from these special float values, which silently returns nil, and then dereferences the nil pointer in the `Cmp` method. An attacker triggers this by sending an HTTP request with `Content-Type: application/yaml` containing YAML tokens `.nan`, `.inf`, or `-.inf` in a schema with numeric constraints (`minimum`, `maximum`, `exclusiveMinimum`, `exclusiveMaximum`, `multipleOf`).

## Affected products

- getkin kin-openapi before 0.144.1

## Identifiers

- CVE-2026-100352
- GHSA-rj39-cv6w-8wv7
- GO-2026-6795

## Timeline

- 2026-10-15: disclosed: GHSA-rj39-cv6w-8wv7 published

## Related threats

- [kin-openapi uncontrolled recursion on circular allOf/anyOf/oneOf schemas](https://junglewise.ai/threats/cve-2026-100354-kin-openapi-uncontrolled-recursion-on-circular-allof-anyof-oneof)
- [kin-openapi SecurityHandler authentication bypass via path encoding](https://junglewise.ai/threats/cve-2026-100351-kin-openapi-validationhandler-security-requirement-bypass-via)
- [kin-openapi deepObject query decoding DoS via repeated regexp compilation](https://junglewise.ai/threats/cve-2026-100350-kin-openapi-deepobject-query-decoding-repeatedly-compiles-an)
- [kin-openapi OpenAPI spec loader nil-pointer panic on self-referential additionalProperties](https://junglewise.ai/threats/cve-2026-100348-kin-openapi-spec-loader-panics-on-a-self-referential)
- [kin-openapi: Unauthenticated denial of service in legacy router](https://junglewise.ai/threats/cve-2026-100347-kin-openapi-unauthenticated-panic-dos-in-openapi3filter-legacy)