---
id: CVE-2026-100348
title: kin-openapi is a Go project for handling OpenAPI files
summary: >-
  kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0,
  openapi3.Loader can dereference a nil SchemaRef.Value while resolving a
  self-referential additionalProperties JSON Reference such as a schema that
  points to its ow…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'
cwe:
  - CWE-476
vendor: getkin
product: kin-openapi
affected:
  - kin-openapi < 0.145.0
published: '2026-10-15'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T16:17:30.607'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-100348'
references:
  - url: >-
      https://github.com/getkin/kin-openapi/commit/88aa64c7cbd03ecadbb419c473bdcaa8b0124c6b
    label: security-advisories@github.com
  - url: 'https://github.com/getkin/kin-openapi/releases/tag/v0.145.0'
    label: security-advisories@github.com
  - url: >-
      https://github.com/getkin/kin-openapi/security/advisories/GHSA-mh7x-f8wq-4jhx
    label: security-advisories@github.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-15T15:44:05.626471Z'
ingestedAt: '2026-10-15T16:13:11.054Z'
---

## Overview

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3.Loader can dereference a nil SchemaRef.Value while resolving a self-referential additionalProperties JSON Reference such as a schema that points to its own additionalProperties member. Loading an attacker-controlled OpenAPI document through LoadFromData, LoadFromFile, or LoadFromURI reaches resolveComponent before document validation and can panic the loading process. Resolved additionalProperties schemas and ordinary recursive schemas do not take the vulnerable nil-value path. This issue is fixed in version 0.145.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.