# CVE-2026-97394: kin-openapi nil-pointer dereference in openapi3filter for OpenAPI 3.1 arrays

Source: https://junglewise.ai/threats/cve-2026-97394-kin-openapi-nil-pointer-dereference-panic-in-openapi3filter-for  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-15. Updated: 2026-10-15  
License: CC BY 4.0 with a link back

CVE-2026-97394 · Severity: high · CVSS 7.5 · Published 2026-10-15

kin-openapi is a Go library for parsing and validating OpenAPI specifications. An unauthenticated attacker can crash applications using the openapi3filter validation component by sending a single HTTP request to an endpoint defined with an OpenAPI 3.1 array-type field lacking an items schema. The crash occurs deterministically during request validation, causing denial of service.

Technologies: [Getkin Kin-Openapi](https://junglewise.ai/threats/technologies/kin-openapi), [github.com/getkin/kin-openapi (Go)](https://junglewise.ai/threats/technologies/github-com-getkin-kin-openapi). Vendors: [Getkin](https://junglewise.ai/threats/vendors/getkin), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-97394 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-97394 being exploited in the wild.

**How severe is CVE-2026-97394?** High severity, with a CVSS score of 7.5, published 15 October 2026.

**Which products and versions are affected?** Getkin Kin-Openapi versions prior to patch; github.com/getkin/kin-openapi (Go) >= 0.136.0, < 0.143.0, SEMVER:introduced=0.136.0,fixed=0.143.0.

**Is there a fix for CVE-2026-97394?** Yes. github.com/getkin/kin-openapi (Go): upgrade to 0.143.0 or later. Until then: Upgrade to a patched version of kin-openapi when available. As a temporary workaround, avoid accepting or loading untrusted OpenAPI 3.1 specifications, or add per-request recover() handlers around ValidateRequest/ValidateResponse calls to prevent process crashes. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-97394 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-97394?** Check whether you run Getkin Kin-Openapi or github.com/getkin/kin-openapi (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/getkin/kin-openapi (Go): upgrade to 0.143.0 or later

  ```sh
  go get github.com/getkin/kin-openapi@v0.143.0
  ```


Upgrade to a patched version of kin-openapi when available. As a temporary workaround, avoid accepting or loading untrusted OpenAPI 3.1 specifications, or add per-request recover() handlers around ValidateRequest/ValidateResponse calls to prevent process crashes.

## Technical details

A nil-pointer dereference occurs in openapi3filter's request/response decoders (UrlencodedBodyDecoder, MultipartBodyDecoder, and parseArray) when processing OpenAPI 3.1 schemas that declare type:array without an items field. OpenAPI 3.1 permits omitted items under JSON Schema 2020-12, but doc.Validate() does not reject such schemas, leaving Schema.Items as nil. The decoders dereference Items.Value without nil checks during schema inspection before parsing form values, triggering a panic. The attack requires no authentication and a non-empty request body to the affected operation.

## Affected products

- getkin kin-openapi versions prior to patch

## Identifiers

- CVE-2026-97394
- GHSA-p6wj-qrr4-pgh5
- GO-2026-6790

## Timeline

- 2026-10-15: disclosed
- 2026-10-15: other: CVE-2026-97394 assigned

## Related threats

- [kin-openapi uncontrolled recursion on circular allOf/anyOf/oneOf schemas](https://junglewise.ai/threats/cve-2026-100354-kin-openapi-uncontrolled-recursion-on-circular-allof-anyof-oneof)
- [kin-openapi SecurityHandler authentication bypass via path encoding](https://junglewise.ai/threats/cve-2026-100351-kin-openapi-validationhandler-security-requirement-bypass-via)
- [kin-openapi deepObject query decoding DoS via repeated regexp compilation](https://junglewise.ai/threats/cve-2026-100350-kin-openapi-deepobject-query-decoding-repeatedly-compiles-an)
- [kin-openapi OpenAPI spec loader nil-pointer panic on self-referential additionalProperties](https://junglewise.ai/threats/cve-2026-100348-kin-openapi-spec-loader-panics-on-a-self-referential)
- [kin-openapi: Unauthenticated denial of service in legacy router](https://junglewise.ai/threats/cve-2026-100347-kin-openapi-unauthenticated-panic-dos-in-openapi3filter-legacy)