{"id":"CVE-2026-100352","aliases":["DEBIAN-CVE-2026-100352","EUVD-2026-102161","GHSA-rj39-cv6w-8wv7","GO-2026-6795","RHSA-2026:82637","RHSA-2026:85266","UBUNTU-CVE-2026-100352","openSUSE-SU-2026:12164-1","openSUSE-SU-2026:12309-1"],"status":"published","title":"kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path","description":"kin-openapi is a Go project for handling OpenAPI files. Prior to 0.148.0, the OpenAPI 3.1 validation path passes YAML NaN and infinity numeric values to santhosh-tekuri/jsonschema v6.0.2 without applying kin-openapi's existing finite-number guards. A remote unauthenticated client can send an application/yaml or application/x-yaml request body containing .nan, .inf, or -.inf to an operation with a numeric constraint, causing the dependency to create and dereference a nil big.Rat during ValidateRequest. Standard net/http servers recover the panic per connection, while other hosts or application goroutines may terminate the process. This issue is fixed in version 0.148.0.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00595,"percentile":0.48772,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-754"],"published":"2026-10-15T15:54:25Z","modified":"2026-11-05T23:25:44Z","fixes":[{"ecosystem":"Go","package":"github.com/getkin/kin-openapi","fixed_in":["0.148.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/getkin/kin-openapi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.148.0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"golang-github-getkin-kin-openapi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.110.0-1","0.117.0-1","0.118.0-1","0.120.0-1","0.122.0-1","0.122.0-2","0.122.0-3","0.123.0-1","0.124.0-1","0.135.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"golang-github-getkin-kin-openapi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.124.0-1","0.135.0-1"]},{"source":"osv","ecosystem":"Debian:14","package":"golang-github-getkin-kin-openapi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.124.0-1","0.135.0-1"]},{"source":"osv","ecosystem":"Go","package":"github.com/getkin/kin-openapi","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.148.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/getkin/kin-openapi","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.148.0"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"hugo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.168.0-0.1.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana13.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.2.3-0.3.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-github-getkin-kin-openapi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.32.0-2","0.80.0-1","0.85.0-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-github-getkin-kin-openapi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.117.0-1","0.120.0-1","0.122.0-3","0.123.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"golang-github-getkin-kin-openapi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.124.0-1","0.135.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"golang-github-getkin-kin-openapi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.124.0-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"hugo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.168.0-2.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"timoni","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.36.0-1.1"}]}],"bundled":14}],"products":[{"vendor":"getkin","product":"kin-openapi"}],"references":[{"url":"https://github.com/getkin/kin-openapi/security/advisories/GHSA-rj39-cv6w-8wv7","tags":["x_refsource_CONFIRM","exploit","advisory","web","article","report"]},{"url":"https://github.com/getkin/kin-openapi/commit/4487f198ab8be0c37d6ca72c54f5dca4dc25270e","tags":["x_refsource_MISC","fix","web","article","report"]},{"url":"https://github.com/getkin/kin-openapi/releases/tag/v0.148.0","tags":["x_refsource_MISC","web","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100352","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-rj39-cv6w-8wv7"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-100352.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-100352","tags":["advisory"]},{"url":"https://github.com/getkin/kin-openapi","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2026:82637","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-100352","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-100353","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-100347","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-100348","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-100349","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-100350","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-100351","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-97394","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-100354","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_82637.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553575","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-97394","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97394","tags":["advisory"]},{"url":"https://github.com/getkin/kin-openapi/commit/30e292371a89ca6d1f91a9553e0aa518b49f838d","tags":["article"]},{"url":"https://github.com/getkin/kin-openapi/releases/tag/v0.143.0","tags":["article"]},{"url":"https://github.com/getkin/kin-openapi/security/advisories/GHSA-p6wj-qrr4-pgh5","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553580","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-100347","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100347","tags":["advisory"]},{"url":"https://github.com/getkin/kin-openapi/commit/f1a5b523b82868d2d9be2e116b4e942892be72c3","tags":["article"]},{"url":"https://github.com/getkin/kin-openapi/releases/tag/v0.145.0","tags":["article"]},{"url":"https://github.com/getkin/kin-openapi/security/advisories/GHSA-fh4f-47mf-f2gj","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553571","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-100348","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100348","tags":["advisory"]},{"url":"https://github.com/getkin/kin-openapi/commit/88aa64c7cbd03ecadbb419c473bdcaa8b0124c6b","tags":["article"]},{"url":"https://github.com/getkin/kin-openapi/security/advisories/GHSA-mh7x-f8wq-4jhx","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553589","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-100349","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100349","tags":["advisory"]},{"url":"https://github.com/getkin/kin-openapi/commit/f5441d67f855ed34d975b3b85665764644ab1459","tags":["article"]},{"url":"https://github.com/getkin/kin-openapi/releases/tag/v0.146.0","tags":["article"]},{"url":"https://github.com/getkin/kin-openapi/security/advisories/GHSA-74vm-87hj-r66f","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553584","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-100350","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100350","tags":["advisory"]},{"url":"https://github.com/getkin/kin-openapi/commit/d090e36b2f1c42c898ba2a687a8f6e25f5ca727f","tags":["article"]},{"url":"https://github.com/getkin/kin-openapi/security/advisories/GHSA-h4r5-mxv5-8mjc","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553587","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-100351","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100351","tags":["advisory"]},{"url":"https://github.com/getkin/kin-openapi/commit/eda80e2676e9f577ceed2dd80e64f16083edb041","tags":["article"]},{"url":"https://github.com/getkin/kin-openapi/releases/tag/v0.147.0","tags":["article"]},{"url":"https://github.com/getkin/kin-openapi/security/advisories/GHSA-23vg-4cjm-66q5","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553588","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-100352","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553592","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-100353","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100353","tags":["advisory"]},{"url":"https://github.com/getkin/kin-openapi/commit/9814d1f2b212f3508bf52296aa9e248b2122a5a9","tags":["article"]},{"url":"https://github.com/getkin/kin-openapi/releases/tag/v0.149.0","tags":["article"]},{"url":"https://github.com/getkin/kin-openapi/security/advisories/GHSA-vrcc-3ch7-hppw","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553590","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-100354","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100354","tags":["advisory"]},{"url":"https://github.com/getkin/kin-openapi/commit/9245cef66c840e27a08409a8a5cd0ee930c5bcff","tags":["article"]},{"url":"https://github.com/getkin/kin-openapi/security/advisories/GHSA-g8cf-rcjf-c8cf","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:85266","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-110816","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-93450","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_85266.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2538979","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-93450","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93450","tags":["advisory"]},{"url":"https://github.com/go-openapi/swag","tags":["article"]},{"url":"https://github.com/go-openapi/swag/blob/v0.27.0/jsonutils/adapters/stdlib/json/adapter.go#L68","tags":["article"]},{"url":"https://github.com/go-openapi/swag/blob/v0.27.0/jsonutils/adapters/stdlib/json/ordered_map.go#L214","tags":["article"]},{"url":"https://github.com/go-openapi/swag/commit/0c24346ced59a25811e8694a915e7131d25ccb0e","tags":["article"]},{"url":"https://github.com/go-openapi/swag/security/advisories/GHSA-xh24-9qpg-8w28","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/go-openapi-swag-jsonutils-before-0.27.1-uncontrolled-recursion-in-ordered-json-marshal-and-unmarshal","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2552954","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-110816","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110816","tags":["advisory"]},{"url":"https://github.com/ljharb/qs/commit/a952e7519338ef0cfb25694a2988848f93333727","tags":["article"]},{"url":"https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw","tags":["article"]},{"url":"https://ubuntu.com/security/CVE-2026-100352","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100347","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100348","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100349","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100350","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100352","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45338","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47911","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58190","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100353","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100354","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78659","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78660","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78663","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78669","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97032","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-100352","title":"kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path","description":"kin-openapi is a Go project for handling OpenAPI files. Prior to 0.148.0, the OpenAPI 3.1 validation path passes YAML NaN and infinity numeric values to santhosh-tekuri/jsonschema v6.0.2 without applying kin-openapi's existing finite-number guards. A remote unauthenticated client can send an application/yaml or application/x-yaml request body containing .nan, .inf, or -.inf to an operation with a numeric constraint, causing the dependency to create and dereference a nil big.Rat during ValidateRequest. Standard net/http servers recover the panic per connection, while other hosts or application goroutines may terminate the process. This issue is fixed in version 0.148.0.","status":"published","published":"2026-10-15T15:54:25.834Z","modified":"2026-10-20T02:46:20.849Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-754"],"updated_at":"2026-11-02T14:20:06.925367Z"}],"euvd":[{"id":"EUVD-2026-102161","description":"kin-openapi is a Go project for handling OpenAPI files. Prior to 0.148.0, the OpenAPI 3.1 validation path passes YAML NaN and infinity numeric values to santhosh-tekuri/jsonschema v6.0.2 without applying kin-openapi's existing finite-number guards. A remote unauthenticated client can send an application/yaml or application/x-yaml request body containing .nan, .inf, or -.inf to an operation with a numeric constraint, causing the dependency to create and dereference a nil big.Rat during ValidateRequest. Standard net/http servers recover the panic per connection, while other hosts or application goroutines may terminate the process. This issue is fixed in version 0.148.0.","status":"published","published":"2026-10-15T15:54:25Z","modified":"2026-10-20T02:46:20Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:59:44.419021Z"}],"ghsa":[{"id":"GHSA-rj39-cv6w-8wv7","title":"kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path","description":"## Summary\n\nkin-openapi guards against `NaN` and `Inf` values in its built-in schema visitor (`visitJSON`) by returning `ErrSchemaInputNaN` / `ErrSchemaInputInf` when a `float64` input violates those constraints. For OAS 3.1 specs, however, `Schema.VisitJSON` routes through `useJSONSchema2020`, which hands the value directly to `santhosh-tekuri/jsonschema/v6` v6.0.2 without applying the same guard.\n\nInside `jsonschema/v6` v6.0.2, `numValidate` builds a `*big.Rat` from the input via `big.Rat.SetString(fmt.Sprintf(\"%v\", v))`. For `NaN`/`Inf` this parse fails silently and returns `nil`. `numValidate` then dereferences the nil `*big.Rat` (in `math/big.(*Rat).Cmp`), producing a Go runtime panic.\n\nAn attacker delivers this by sending an HTTP request with `Content-Type: application/yaml` (or `application/x-yaml`) and a YAML body containing `.nan`, `.inf`, or `-.inf`. The `YamlBodyDecoder` decodes those tokens into `math.NaN()` / `math.Inf(±1)` (standard YAML 1.2 behavior), and they propagate to the unguarded `useJSONSchema2020` path whenever the schema declares a numeric constraint (`minimum`, `maximum`, `exclusiveMinimum`, `exclusiveMaximum`, or `multipleOf`).\n\n## Details\n### Root Cause\n\nThe built-in visitor `visitJSON` at `openapi3/schema.go:1968` guards NaN/Inf explicitly:\n\n```go\ncase float64:\n    if math.IsNaN(value) {\n        return ErrSchemaInputNaN\n    }\n    if math.IsInf(value, 0) {\n        return ErrSchemaInputInf\n    }\n```\n\nFor OAS 3.1 specs, `VisitJSON` dispatches to `useJSONSchema2020` (`openapi3/schema_jsonschema_validator.go:204`), which contains no such guard:\n\n```go\nfunc (schema *Schema) useJSONSchema2020(settings *schemaValidationSettings, value any) error {\n    validator, err := newJSONSchemaValidator(schema)\n    if err != nil {\n        return schema.visitJSON(settings, value)\n    }\n    return validator.validate(value)      // value handed straight through\n}\n```\n\n`jsonSchemaValidator.validate` calls `jsonschema/v6.Schema.Validate` (line 146), which reaches `numValidate` in v6.0.2. There, `big.Rat.SetString(fmt.Sprintf(\"%v\", v))` returns `(nil, false)` for `NaN`/`Inf`, and the code dereferences the `nil` `*big.Rat` in `Rat.Cmp`, causing the panic.\n\n## Proof of Concept\n\n### Environment\n\n- kin-openapi v0.144.0 (tag `v0.144.0`, commit `f0407d5`)\n- santhosh-tekuri/jsonschema/v6 v6.0.2 (transitive dep)\n- Go 1.26.7\n\n### Spec\n\nMinimal OAS 3.1 spec (`spec.yaml`) declaring a YAML body with a numeric constraint:\n\n```yaml\nopenapi: '3.1.0'\ninfo: { title: Test, version: '1.0' }\npaths:\n  /test:\n    post:\n      requestBody:\n        required: true\n        content:\n          application/yaml:\n            schema:\n              type: number\n              minimum: 0\n      responses:\n        '200': { description: OK }\n```\n\n### Trigger\n\nA single `POST /test` with `Content-Type: application/yaml` and body `.nan`, `.inf`, or `-.inf`. All three variants panic:\n\n```\n=== RUN   TestNaNInf\n[nan]    PANIC (confirms vuln): runtime error: invalid memory address or nil pointer dereference\n[inf]    PANIC (confirms vuln): runtime error: invalid memory address or nil pointer dereference\n[neginf] PANIC (confirms vuln): runtime error: invalid memory address or nil pointer dereference\n```\n\n### Panic stack trace (confirms exact chain)\n\n```\npanic: runtime error: invalid memory address or nil pointer dereference\n\nmath/big.(*Rat).Cmp(0x0, ...)                                       \u003c- nil *big.Rat dereferenced\n    C:/Program Files/Go/src/math/big/rat.go:492\ngithub.com/santhosh-tekuri/jsonschema/v6.(*validator).numValidate(...)\n    .../jsonschema/v6@v6.0.2/validator.go:525\ngithub.com/santhosh-tekuri/jsonschema/v6.(*validator).validate(...)\n    .../jsonschema/v6@v6.0.2/validator.go:168\ngithub.com/santhosh-tekuri/jsonschema/v6.(*Schema).validate(...)\n    .../jsonschema/v6@v6.0.2/validator.go:34\ngithub.com/getkin/kin-openapi/openapi3.(*jsonSchemaValidator).validate(...)\n    openapi3/schema_jsonschema_validator.go:146\ngithub.com/getkin/kin-openapi/openapi3.(*Schema).useJSONSchema2020(...)   \u003c- MISSING NaN/Inf guard\n    openapi3/schema_jsonschema_validator.go:211\ngithub.com/getkin/kin-openapi/openapi3.(*Schema).VisitJSON(...)\n    openapi3/schema.go:1946\ngithub.com/getkin/kin-openapi/openapi3filter.ValidateRequestBody(...)\n    openapi3filter/validate_request.go:364\ngithub.com/getkin/kin-openapi/openapi3filter.ValidateRequest(...)\n    openapi3filter/validate_request.go:96\n```\n\n### net/http behavior (severity nuance)\n\nBehind a standard `net/http` server, the panic is recovered per-connection. The client sees a dropped connection; the server process continues:\n\n```\nSending POST /test body=.nan against real net/http server...\n2026/08/25 http: panic serving 127.0.0.1:40625: runtime error: invalid memory address or nil pointer dereference\nCLIENT ERROR (connection dropped): Post \".../test\": EOF\nProcess still alive after request: true\n```\n\nThis is a **recoverable panic**, unlike the recursion finding. `recover()` catches it (verified by capturing the panic value in a `defer` in the same goroutine). Non-`net/http` hosts or validation performed in an application-spawned goroutine are not covered by that recovery and would experience a full-process crash.\n\n### Fix verification\n\nUpgrading only the transitive dependency to `jsonschema/v6@v6.0.3` (via `go get github.com/santhosh-tekuri/jsonschema/v6@v6.0.3`) eliminates the panic entirely; all three payloads return a clean validation error:\n\n```\n[nan]    Returned normally, err = request body has an error: doesn't match schema: validation failed due to: at '': invalid jsonType float64\n[inf]    Returned normally, err = request body has an error: doesn't match schema: validation failed due to: at '': invalid jsonType float64\n[neginf] Returned normally, err = request body has an error: doesn't match schema: validation failed due to: at '': invalid jsonType float64\n```\n\nThis confirms the upstream `jsonschema/v6` v6.0.3 release treats the NaN/Inf case as a bug and fixes it at the source. It also confirms `useJSONSchema2020` is the reachable path: patching only the transitive dep removes the panic without touching kin-openapi code.\n\n## Why This Is a Vulnerability, Not by Design\n\n- The library explicitly refuses NaN/Inf in its own visitor (`ErrSchemaInputNaN` / `ErrSchemaInputInf` at `schema.go:1968`). The stated policy is: these values are not allowed.\n- The OAS 3.1 dispatch (`useJSONSchema2020`) simply omits the same guard — a coding gap, not a design decision.\n- Upstream `jsonschema/v6` v6.0.3 fixes the same case as a bug. Two independent code owners agree it should not panic.\n- The trigger is a single HTTP request body an unauthenticated client can send. There is no legitimate content-authoring reason to submit `.nan` / `.inf` as a numeric field.\n\n## Impact\n\n- **Per-request denial of service (net/http hosts).** Every crafted request kills its own connection with zero attacker cost. Sustained flooding degrades service reliability and log noise.\n- **Full-process denial of service (non-net/http hosts or goroutine-spawned validation).** No `net/http` recovery wrapper is present; the whole process crashes on a single request.\n- **Attack surface is any OAS 3.1 API that accepts YAML bodies with numeric constraints.** These constraints (`minimum`, `maximum`, `exclusiveMinimum`, `exclusiveMaximum`, `multipleOf`) are common on any numeric field with a range.","status":"published","published":"2026-10-15T20:20:27Z","modified":"2026-10-15T20:20:28Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-754"],"updated_at":"2026-11-02T14:41:32.483482Z"}],"nvd":[{"id":"CVE-2026-100352","description":"kin-openapi is a Go project for handling OpenAPI files. Prior to 0.148.0, the OpenAPI 3.1 validation path passes YAML NaN and infinity numeric values to santhosh-tekuri/jsonschema v6.0.2 without applying kin-openapi's existing finite-number guards. A remote unauthenticated client can send an application/yaml or application/x-yaml request body containing .nan, .inf, or -.inf to an operation with a numeric constraint, causing the dependency to create and dereference a nil big.Rat during ValidateRequest. Standard net/http servers recover the panic per connection, while other hosts or application goroutines may terminate the process. This issue is fixed in version 0.148.0.","status":"published","published":"2026-10-15T16:17:31.307Z","modified":"2026-10-20T03:17:11.19Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-754"],"updated_at":"2026-11-02T14:12:59.751798Z"}],"osv":[{"id":"CVE-2026-100352","title":"kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path","description":"kin-openapi is a Go project for handling OpenAPI files. Prior to 0.148.0, the OpenAPI 3.1 validation path passes YAML NaN and infinity numeric values to santhosh-tekuri/jsonschema v6.0.2 without applying kin-openapi's existing finite-number guards. A remote unauthenticated client can send an application/yaml or application/x-yaml request body containing .nan, .inf, or -.inf to an operation with a numeric constraint, causing the dependency to create and dereference a nil big.Rat during ValidateRequest. Standard net/http servers recover the panic per connection, while other hosts or application goroutines may terminate the process. This issue is fixed in version 0.148.0.","status":"published","published":"2026-10-15T15:54:25.834Z","modified":"2026-11-05T23:25:44.340700901Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-754"],"updated_at":"2026-11-06T00:02:13.631839Z"},{"id":"DEBIAN-CVE-2026-100352","description":"kin-openapi is a Go project for handling OpenAPI files. Prior to 0.148.0, the OpenAPI 3.1 validation path passes YAML NaN and infinity numeric values to santhosh-tekuri/jsonschema v6.0.2 without applying kin-openapi's existing finite-number guards. A remote unauthenticated client can send an application/yaml or application/x-yaml request body containing .nan, .inf, or -.inf to an operation with a numeric constraint, causing the dependency to create and dereference a nil big.Rat during ValidateRequest. Standard net/http servers recover the panic per connection, while other hosts or application goroutines may terminate the process. This issue is fixed in version 0.148.0.","status":"published","published":"2026-10-15T16:17:31.307Z","modified":"2026-10-25T17:00:06.847307503Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:48.440897Z"},{"id":"GHSA-rj39-cv6w-8wv7","title":"kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path","description":"## Summary\n\nkin-openapi guards against `NaN` and `Inf` values in its built-in schema visitor (`visitJSON`) by returning `ErrSchemaInputNaN` / `ErrSchemaInputInf` when a `float64` input violates those constraints. For OAS 3.1 specs, however, `Schema.VisitJSON` routes through `useJSONSchema2020`, which hands the value directly to `santhosh-tekuri/jsonschema/v6` v6.0.2 without applying the same guard.\n\nInside `jsonschema/v6` v6.0.2, `numValidate` builds a `*big.Rat` from the input via `big.Rat.SetString(fmt.Sprintf(\"%v\", v))`. For `NaN`/`Inf` this parse fails silently and returns `nil`. `numValidate` then dereferences the nil `*big.Rat` (in `math/big.(*Rat).Cmp`), producing a Go runtime panic.\n\nAn attacker delivers this by sending an HTTP request with `Content-Type: application/yaml` (or `application/x-yaml`) and a YAML body containing `.nan`, `.inf`, or `-.inf`. The `YamlBodyDecoder` decodes those tokens into `math.NaN()` / `math.Inf(±1)` (standard YAML 1.2 behavior), and they propagate to the unguarded `useJSONSchema2020` path whenever the schema declares a numeric constraint (`minimum`, `maximum`, `exclusiveMinimum`, `exclusiveMaximum`, or `multipleOf`).\n\n## Details\n### Root Cause\n\nThe built-in visitor `visitJSON` at `openapi3/schema.go:1968` guards NaN/Inf explicitly:\n\n```go\ncase float64:\n    if math.IsNaN(value) {\n        return ErrSchemaInputNaN\n    }\n    if math.IsInf(value, 0) {\n        return ErrSchemaInputInf\n    }\n```\n\nFor OAS 3.1 specs, `VisitJSON` dispatches to `useJSONSchema2020` (`openapi3/schema_jsonschema_validator.go:204`), which contains no such guard:\n\n```go\nfunc (schema *Schema) useJSONSchema2020(settings *schemaValidationSettings, value any) error {\n    validator, err := newJSONSchemaValidator(schema)\n    if err != nil {\n        return schema.visitJSON(settings, value)\n    }\n    return validator.validate(value)      // value handed straight through\n}\n```\n\n`jsonSchemaValidator.validate` calls `jsonschema/v6.Schema.Validate` (line 146), which reaches `numValidate` in v6.0.2. There, `big.Rat.SetString(fmt.Sprintf(\"%v\", v))` returns `(nil, false)` for `NaN`/`Inf`, and the code dereferences the `nil` `*big.Rat` in `Rat.Cmp`, causing the panic.\n\n## Proof of Concept\n\n### Environment\n\n- kin-openapi v0.144.0 (tag `v0.144.0`, commit `f0407d5`)\n- santhosh-tekuri/jsonschema/v6 v6.0.2 (transitive dep)\n- Go 1.26.7\n\n### Spec\n\nMinimal OAS 3.1 spec (`spec.yaml`) declaring a YAML body with a numeric constraint:\n\n```yaml\nopenapi: '3.1.0'\ninfo: { title: Test, version: '1.0' }\npaths:\n  /test:\n    post:\n      requestBody:\n        required: true\n        content:\n          application/yaml:\n            schema:\n              type: number\n              minimum: 0\n      responses:\n        '200': { description: OK }\n```\n\n### Trigger\n\nA single `POST /test` with `Content-Type: application/yaml` and body `.nan`, `.inf`, or `-.inf`. All three variants panic:\n\n```\n=== RUN   TestNaNInf\n[nan]    PANIC (confirms vuln): runtime error: invalid memory address or nil pointer dereference\n[inf]    PANIC (confirms vuln): runtime error: invalid memory address or nil pointer dereference\n[neginf] PANIC (confirms vuln): runtime error: invalid memory address or nil pointer dereference\n```\n\n### Panic stack trace (confirms exact chain)\n\n```\npanic: runtime error: invalid memory address or nil pointer dereference\n\nmath/big.(*Rat).Cmp(0x0, ...)                                       \u003c- nil *big.Rat dereferenced\n    C:/Program Files/Go/src/math/big/rat.go:492\ngithub.com/santhosh-tekuri/jsonschema/v6.(*validator).numValidate(...)\n    .../jsonschema/v6@v6.0.2/validator.go:525\ngithub.com/santhosh-tekuri/jsonschema/v6.(*validator).validate(...)\n    .../jsonschema/v6@v6.0.2/validator.go:168\ngithub.com/santhosh-tekuri/jsonschema/v6.(*Schema).validate(...)\n    .../jsonschema/v6@v6.0.2/validator.go:34\ngithub.com/getkin/kin-openapi/openapi3.(*jsonSchemaValidator).validate(...)\n    openapi3/schema_jsonschema_validator.go:146\ngithub.com/getkin/kin-openapi/openapi3.(*Schema).useJSONSchema2020(...)   \u003c- MISSING NaN/Inf guard\n    openapi3/schema_jsonschema_validator.go:211\ngithub.com/getkin/kin-openapi/openapi3.(*Schema).VisitJSON(...)\n    openapi3/schema.go:1946\ngithub.com/getkin/kin-openapi/openapi3filter.ValidateRequestBody(...)\n    openapi3filter/validate_request.go:364\ngithub.com/getkin/kin-openapi/openapi3filter.ValidateRequest(...)\n    openapi3filter/validate_request.go:96\n```\n\n### net/http behavior (severity nuance)\n\nBehind a standard `net/http` server, the panic is recovered per-connection. The client sees a dropped connection; the server process continues:\n\n```\nSending POST /test body=.nan against real net/http server...\n2026/08/25 http: panic serving 127.0.0.1:40625: runtime error: invalid memory address or nil pointer dereference\nCLIENT ERROR (connection dropped): Post \".../test\": EOF\nProcess still alive after request: true\n```\n\nThis is a **recoverable panic**, unlike the recursion finding. `recover()` catches it (verified by capturing the panic value in a `defer` in the same goroutine). Non-`net/http` hosts or validation performed in an application-spawned goroutine are not covered by that recovery and would experience a full-process crash.\n\n### Fix verification\n\nUpgrading only the transitive dependency to `jsonschema/v6@v6.0.3` (via `go get github.com/santhosh-tekuri/jsonschema/v6@v6.0.3`) eliminates the panic entirely; all three payloads return a clean validation error:\n\n```\n[nan]    Returned normally, err = request body has an error: doesn't match schema: validation failed due to: at '': invalid jsonType float64\n[inf]    Returned normally, err = request body has an error: doesn't match schema: validation failed due to: at '': invalid jsonType float64\n[neginf] Returned normally, err = request body has an error: doesn't match schema: validation failed due to: at '': invalid jsonType float64\n```\n\nThis confirms the upstream `jsonschema/v6` v6.0.3 release treats the NaN/Inf case as a bug and fixes it at the source. It also confirms `useJSONSchema2020` is the reachable path: patching only the transitive dep removes the panic without touching kin-openapi code.\n\n## Why This Is a Vulnerability, Not by Design\n\n- The library explicitly refuses NaN/Inf in its own visitor (`ErrSchemaInputNaN` / `ErrSchemaInputInf` at `schema.go:1968`). The stated policy is: these values are not allowed.\n- The OAS 3.1 dispatch (`useJSONSchema2020`) simply omits the same guard — a coding gap, not a design decision.\n- Upstream `jsonschema/v6` v6.0.3 fixes the same case as a bug. Two independent code owners agree it should not panic.\n- The trigger is a single HTTP request body an unauthenticated client can send. There is no legitimate content-authoring reason to submit `.nan` / `.inf` as a numeric field.\n\n## Impact\n\n- **Per-request denial of service (net/http hosts).** Every crafted request kills its own connection with zero attacker cost. Sustained flooding degrades service reliability and log noise.\n- **Full-process denial of service (non-net/http hosts or goroutine-spawned validation).** No `net/http` recovery wrapper is present; the whole process crashes on a single request.\n- **Attack surface is any OAS 3.1 API that accepts YAML bodies with numeric constraints.** These constraints (`minimum`, `maximum`, `exclusiveMinimum`, `exclusiveMaximum`, `multipleOf`) are common on any numeric field with a range.","status":"published","published":"2026-10-15T20:20:27Z","modified":"2026-11-05T23:25:44.340700901Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-754"],"updated_at":"2026-11-06T00:02:13.631839Z"},{"id":"RHSA-2026:82637","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-10-17T10:21:05Z","modified":"2026-10-20T10:43:36.163539737Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:85266","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-10-20T10:18:04Z","modified":"2026-10-20T10:43:38.38485781Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"UBUNTU-CVE-2026-100352","description":"kin-openapi is a Go project for handling OpenAPI files. Prior to 0.148.0, the OpenAPI 3.1 validation path passes YAML NaN and infinity numeric values to santhosh-tekuri/jsonschema v6.0.2 without applying kin-openapi's existing finite-number guards. A remote unauthenticated client can send an application/yaml or application/x-yaml request body containing .nan, .inf, or -.inf to an operation with a numeric constraint, causing the dependency to create and dereference a nil big.Rat during ValidateRequest. Standard net/http servers recover the panic per connection, while other hosts or application goroutines may terminate the process. This issue is fixed in version 0.148.0.","status":"published","published":"2026-10-15T16:17:00Z","modified":"2026-10-28T17:50:26Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:58.519486Z"},{"id":"GO-2026-6795","title":"kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path in github.com/getkin/kin-openapi","description":"kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path in github.com/getkin/kin-openapi","status":"published","published":"2026-11-05T22:53:53Z","modified":"2026-11-05T23:15:12.96480634Z","updated_at":"2026-11-06T00:02:13.631839Z"},{"id":"openSUSE-SU-2026:12164-1","title":"hugo-0.168.0-2.1 on GA media","description":"These are all security issues fixed in the hugo-0.168.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-17T00:00:00Z","modified":"2026-10-18T11:15:03.240232812Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:12309-1","title":"timoni-0.36.0-1.1 on GA media","description":"These are all security issues fixed in the timoni-0.36.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-27T00:00:00Z","modified":"2026-10-28T17:23:15.827407426Z","updated_at":"2026-11-02T16:58:40.245664Z"}]}}