Is CVE-2026-100354 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-100354 being exploited in the wild.

How severe is CVE-2026-100354?

High severity, with a CVSS score of 7.5, published 15 October 2026.

Which products and versions are affected?

Getkin Kin-Openapi v0.144.0 and likely earlier versions; github.com/getkin/kin-openapi (Go) < 0.149.0, SEMVER:introduced=0,fixed=0.149.0.

Is there a fix for CVE-2026-100354?

Yes. github.com/getkin/kin-openapi (Go): upgrade to 0.149.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-100354 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-100354?

Check whether you run Getkin Kin-Openapi or github.com/getkin/kin-openapi (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100354: kin-openapi uncontrolled recursion on circular allOf/anyOf/oneOf schemas

Q: Is there a fix for CVE-2026-100354?

Yes. github.com/getkin/kin-openapi (Go): upgrade to 0.149.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-100354 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-100354?

Check whether you run Getkin Kin-Openapi or github.com/getkin/kin-openapi (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100354 · Severity: high · CVSS 7.5 · Published 2026-10-15

kin-openapi is a library for validating API requests and responses against OpenAPI schemas. An attacker can craft a malicious OpenAPI specification with circular schema references that causes the entire process to crash with a fatal, unrecoverable stack overflow when the schema is used for request or response validation. This allows complete denial of service of any application using the library to validate untrusted schemas.

Technologies: Getkin Kin-Openapi, github.com/getkin/kin-openapi (Go). Vendors: Getkin, Go.

Quick answers

Is CVE-2026-100354 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-100354 being exploited in the wild.
How severe is CVE-2026-100354?: High severity, with a CVSS score of 7.5, published 15 October 2026.
Which products and versions are affected?: Getkin Kin-Openapi v0.144.0 and likely earlier versions; github.com/getkin/kin-openapi (Go) < 0.149.0, SEMVER:introduced=0,fixed=0.149.0.
Is there a fix for CVE-2026-100354?: Yes. github.com/getkin/kin-openapi (Go): upgrade to 0.149.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-100354 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-100354?: Check whether you run Getkin Kin-Openapi or github.com/getkin/kin-openapi (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/getkin/kin-openapi (Go): upgrade to 0.149.0 or later
```
go get github.com/getkin/kin-openapi@v0.149.0
```

Technical details

The vulnerability exists in two runtime validation paths (visitJSON and decodeValue) that lack cycle detection when traversing allOf/anyOf/oneOf combinators, unlike the spec-time validator which has stack-based protection. A schema that references itself through these combinators triggers unbounded recursion in Go, causing a fatal stack overflow that cannot be caught by recover() and terminates the entire process including all unrelated goroutines.

Affected products

getkin kin-openapi v0.144.0 and likely earlier versions

Identifiers

CVE-2026-100354
GHSA-g8cf-rcjf-c8cf
GO-2026-6785

Timeline

2026-10-15: disclosed: GitHub Security Advisory GHSA-g8cf-rcjf-c8cf published

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.