CVE-2026-100352

{
  "etk_id": "ETK-2026-1881",
  "cve_id": "CVE-2026-100352",
  "display_id": "CVE-2026-100352",
  "ghsa_id": "GHSA-rj39-cv6w-8wv7",
  "euvd_id": "EUVD-2026-102161",
  "status": "published",
  "anchor_state": "anchored",
  "title": "kin-openapi YAML schema validation panic",
  "summary": "Versions of github.com/getkin/kin-openapi before v0.148.0 can panic while validating OAS 3.1 YAML request bodies against numeric constraints. An unauthenticated client can disrupt requests and may terminate applications that do not recover validation panics.",
  "mitigation": "Upgrade github.com/getkin/kin-openapi to v0.148.0 or later. Until upgraded, disable or reject YAML request bodies for affected OAS 3.1 endpoints.",
  "vendor": "go",
  "product": "github.com/getkin/kin-openapi",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "v0.144.0"
      ],
      "ecosystem": "go",
      "fixed_versions": [
        "v0.148.0"
      ],
      "package_name": null,
      "purl": null
    }
  ],
  "cwes": [
    754
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss_score": 0.0043,
  "epss_percentile": 0.3555,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 12.502537333333333,
  "t0_at": "2026-10-15T15:54:25.834000+00:00",
  "signals": {
    "public_poc": {
      "at": "2026-08-27T10:16:27+00:00",
      "days": -49.23470872685185,
      "is_lower_bound": false,
      "measured_at": "2026-10-15T15:54:25.834000+00:00",
      "url": "https://github.com/getkin/kin-openapi/security/advisories/GHSA-rj39-cv6w-8wv7"
    },
    "trigger_signal": {
      "at": "2026-10-15T15:54:25.834000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-15T15:54:25.834000+00:00",
      "url": "https://github.com/getkin/kin-openapi/security/advisories/GHSA-rj39-cv6w-8wv7"
    }
  }
}