Is CVE-2026-97394 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-97394 being exploited in the wild.

How severe is CVE-2026-97394?

High severity, with a CVSS score of 7.5, published 15 October 2026.

Which products and versions are affected?

Getkin Kin-Openapi versions prior to patch; github.com/getkin/kin-openapi (Go) >= 0.136.0, < 0.143.0, SEMVER:introduced=0.136.0,fixed=0.143.0.

How is CVE-2026-97394 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-97394?

Check whether you run Getkin Kin-Openapi or github.com/getkin/kin-openapi (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-97394: kin-openapi nil-pointer dereference in openapi3filter for OpenAPI 3.1 arrays

Q: Is there a fix for CVE-2026-97394?

Yes. github.com/getkin/kin-openapi (Go): upgrade to 0.143.0 or later. Until then: Upgrade to a patched version of kin-openapi when available. As a temporary workaround, avoid accepting or loading untrusted OpenAPI 3.1 specifications, or add per-request recover() handlers around ValidateRequest/ValidateResponse calls to prevent process crashes. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-97394 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-97394?

Check whether you run Getkin Kin-Openapi or github.com/getkin/kin-openapi (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-97394 · Severity: high · CVSS 7.5 · Published 2026-10-15

kin-openapi is a Go library for parsing and validating OpenAPI specifications. An unauthenticated attacker can crash applications using the openapi3filter validation component by sending a single HTTP request to an endpoint defined with an OpenAPI 3.1 array-type field lacking an items schema. The crash occurs deterministically during request validation, causing denial of service.

Technologies: Getkin Kin-Openapi, github.com/getkin/kin-openapi (Go). Vendors: Getkin, Go.

Quick answers

Is CVE-2026-97394 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-97394 being exploited in the wild.
How severe is CVE-2026-97394?: High severity, with a CVSS score of 7.5, published 15 October 2026.
Which products and versions are affected?: Getkin Kin-Openapi versions prior to patch; github.com/getkin/kin-openapi (Go) >= 0.136.0, < 0.143.0, SEMVER:introduced=0.136.0,fixed=0.143.0.
Is there a fix for CVE-2026-97394?: Yes. github.com/getkin/kin-openapi (Go): upgrade to 0.143.0 or later. Until then: Upgrade to a patched version of kin-openapi when available. As a temporary workaround, avoid accepting or loading untrusted OpenAPI 3.1 specifications, or add per-request recover() handlers around ValidateRequest/ValidateResponse calls to prevent process crashes. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-97394 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-97394?: Check whether you run Getkin Kin-Openapi or github.com/getkin/kin-openapi (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/getkin/kin-openapi (Go): upgrade to 0.143.0 or later
```
go get github.com/getkin/kin-openapi@v0.143.0
```

Upgrade to a patched version of kin-openapi when available. As a temporary workaround, avoid accepting or loading untrusted OpenAPI 3.1 specifications, or add per-request recover() handlers around ValidateRequest/ValidateResponse calls to prevent process crashes.

Technical details

A nil-pointer dereference occurs in openapi3filter's request/response decoders (UrlencodedBodyDecoder, MultipartBodyDecoder, and parseArray) when processing OpenAPI 3.1 schemas that declare type:array without an items field. OpenAPI 3.1 permits omitted items under JSON Schema 2020-12, but doc.Validate() does not reject such schemas, leaving Schema.Items as nil. The decoders dereference Items.Value without nil checks during schema inspection before parsing form values, triggering a panic. The attack requires no authentication and a non-empty request body to the affected operation.

Affected products

getkin kin-openapi versions prior to patch

Identifiers

CVE-2026-97394
GHSA-p6wj-qrr4-pgh5
GO-2026-6790

Timeline

2026-10-15: disclosed
2026-10-15: other: CVE-2026-97394 assigned

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.