CVE-2026-100350Medium· 5.3▾ Sunlitkin-openapi is a Go project for handling OpenAPI files. From 0.145.0 until 0.146.0, openapi3filter repeatedly calls regexp.MustCompile for the same parameter-name regular expression inside the per-query-key loop in urlValuesDecoder.Decod…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
kin-openapi is a Go project for handling OpenAPI files. From 0.145.0 until 0.146.0, openapi3filter repeatedly calls regexp.MustCompile for the same parameter-name regular expression inside the per-query-key loop in urlValuesDecoder.DecodeObject used to decode a deepObject query parameter. An unauthenticated remote client can send an affected endpoint a request containing many unrelated query keys, causing ValidateRequest to perform work and allocations proportional to the attacker-controlled key count for every deepObject parameter. The expression itself is fixed and this is not regular expression denial of service; the resource consumption comes from loop-invariant recompilation. This issue is fixed in version 0.146.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-100349High· 8.2kin-openapi is a Go project for handling OpenAPI files
CVE-2026-89425High· 7.5UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound
CVE-2026-87908High· 7.5multiparty is a Node.js library for parsing multipart/form-data request bodies
CVE-2026-48779High· 7.5ws is an open source WebSocket client and server for Node.js
CVE-2026-100354High· 7.5kin-openapi is a Go project for handling OpenAPI files
CVE-2026-100353High· 7.5kin-openapi is a Go project for handling OpenAPI files