Source: golang-github-getkin-kin-openapi Version: 0.135.0-1 X-Debbugs-CC: [email protected] Severity: important Tags: security upstream
Hi, The following vulnerabilities were published for golang-github-getkin-kin-openapi. CVE-2026-100347[0]: | kin-openapi is a Go project for handling OpenAPI files. Prior to | 0.145.0, openapi3filter.ValidationHandler uses the routers/legacy | router, which passes an unsupported or non-canonical HTTP method for | an existing static path to openapi3.PathItem.GetOperation. The | default branch of GetOperation panics before authentication runs, so | an unauthenticated remote client can repeatedly send methods such as | PROPFIND or lowercase get to abort connections and generate stack- | trace log growth. The specific panic requires an exact static path; | a concrete path matched only by a templated route does not reach the | same sink. This issue is fixed in version 0.145.0. CVE-2026-100348[1]: | kin-openapi is a Go project for handling OpenAPI files. Prior to | 0.145.0, openapi3.Loader can dereference a nil SchemaRef.Value while | resolving a self-referential additionalProperties JSON Reference | such as a schema that points to its own additionalProperties member. | Loading an attacker-controlled OpenAPI document through | LoadFromData, LoadFromFile, or LoadFromURI reaches resolveComponent | before document validation and can panic the loading process. | Resolved additionalProperties schemas and ordinary recursive schemas | do not take the vulnerable nil-value path. This issue is fixed in | version 0.145.0. CVE-2026-100349[2]: | kin-openapi is a Go project for handling OpenAPI files. Prior to | 0.146.0, openapi3filter.ValidateResponse passes a nil response | header schema to decodeValue when an OpenAPI document declares the | header with content instead of schema. The document passes | validation, but every response validation for the affected operation | dereferences the nil schema and panics even when the response does | not contain the declared header. Applications that ingest an | untrusted specification can expose this as remote availability | impact, while applications using only trusted local specifications | still crash when the affected operation is exercised. This issue is | fixed in version 0.146.0. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-100347 https://www.cve.org/CVERecord?id=CVE-2026-100347 [1] https://security-tracker.debian.org/tracker/CVE-2026-100348 https://www.cve.org/CVERecord?id=CVE-2026-100348 [2] https://security-tracker.debian.org/tracker/CVE-2026-100349 https://www.cve.org/CVERecord?id=CVE-2026-100349 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
