CVE-2026-97394

{
  "etk_id": "ETK-2026-1705",
  "cve_id": "CVE-2026-97394",
  "display_id": "CVE-2026-97394",
  "ghsa_id": "GHSA-p6wj-qrr4-pgh5",
  "euvd_id": "EUVD-2026-102143",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Nil-pointer denial of service in kin-openapi openapi3filter",
  "summary": "Versions before 0.143.0 can panic when openapi3filter processes certain OpenAPI 3.1 array schemas that omit an item definition. An unauthenticated client can cause denial of service when an application exposes an affected request or response validation path and does not contain the resulting panic.",
  "mitigation": "Upgrade github.com/getkin/kin-openapi to version 0.143.0 or later. Until then, correct or reject OpenAPI 3.1 array schemas without items and use panic recovery around request handling.",
  "vendor": "go",
  "product": "github.com/getkin/kin-openapi",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0.136.0, < 0.143.0"
      ],
      "ecosystem": "go",
      "fixed_versions": [
        "0.143.0"
      ],
      "package_name": "github.com/getkin/kin-openapi",
      "purl": "pkg:golang/github.com/getkin/kin-openapi"
    }
  ],
  "cwes": [
    248
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss_score": 0.0044,
  "epss_percentile": 0.3696,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 9.36362335,
  "t0_at": "2026-10-15T15:29:05.238000+00:00",
  "signals": {
    "public_poc": {
      "at": "2026-07-21T12:49:08+00:00",
      "days": -86.11107914351852,
      "is_lower_bound": false,
      "measured_at": "2026-10-15T15:29:05.238000+00:00",
      "url": "https://github.com/getkin/kin-openapi/security/advisories/GHSA-p6wj-qrr4-pgh5"
    },
    "trigger_signal": {
      "at": "2026-10-15T15:29:05.238000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-15T15:29:05.238000+00:00",
      "url": "https://github.com/getkin/kin-openapi/security/advisories/GHSA-p6wj-qrr4-pgh5"
    }
  }
}