---
id: CVE-2026-100354
title: kin-openapi is a Go project for handling OpenAPI files
summary: >-
  kin-openapi is a Go project for handling OpenAPI files. Prior to 0.149.0,
  runtime request, response, and direct schema validation lacks cycle detection
  when an allOf, anyOf, or oneOf chain refers back to an ancestor schema, even
  though l…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-674
vendor: getkin
product: kin-openapi
affected:
  - kin-openapi < 0.149.0
published: '2026-10-15'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T19:17:12.943'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-100354'
references:
  - url: >-
      https://github.com/getkin/kin-openapi/commit/9245cef66c840e27a08409a8a5cd0ee930c5bcff
    label: security-advisories@github.com
  - url: 'https://github.com/getkin/kin-openapi/releases/tag/v0.149.0'
    label: security-advisories@github.com
  - url: >-
      https://github.com/getkin/kin-openapi/security/advisories/GHSA-g8cf-rcjf-c8cf
    label: security-advisories@github.com
  - url: >-
      https://github.com/getkin/kin-openapi/security/advisories/GHSA-g8cf-rcjf-c8cf
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-15T18:31:31.817575Z'
ingestedAt: '2026-10-15T17:18:20.096Z'
---

## Overview

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.149.0, runtime request, response, and direct schema validation lacks cycle detection when an allOf, anyOf, or oneOf chain refers back to an ancestor schema, even though loading and document validation accept the circular reference. A request or response that reaches the affected schema causes unbounded recursion in Schema.visitJSON or openapi3filter.decodeValue and exhausts the Go goroutine stack. The resulting fatal stack overflow cannot be caught with recover and terminates the entire process, including unrelated requests. This issue is fixed in version 0.149.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.