{"id":"CVE-2026-100348","kind":"vulnerability","aliases":["CVE-2026-100348","GHSA-mh7x-f8wq-4jhx","GO-2026-6789"],"related":[],"title":"kin-openapi spec loader panics on a self-referential additionalProperties $ref (nil-pointer DoS)","description":"The defect\n----------\nConfirmed at HEAD (f0407d5, v0.144.0). openapi3/loader.go, inside resolveComponent's drill closure (around line 455), the case *SchemaRef branch for pathPart == \"additionalProperties\" dereferences c.Value.AdditionalProperties with no nil-check on c.Value:\n\n    case *SchemaRef:\n        if pathPart == \"additionalProperties\" {\n            if ap := c.Value.AdditionalProperties.Has; ap != nil {   // c.Value can be nil here\n                cursor = *ap\n            } else {\n                cursor = c.Value.AdditionalProperties.Schema\n            }\n            attempted = true\n        }\n\nWhen a $ref fragment drills through .../additionalProperties of a schema whose Value is still nil (a pure, not-yet-resolved $ref, or a self-reference resolved before its own Value is set), c.Value is nil and the .AdditionalProperties access panics.\n\nInput and attacker\n-------------------\nA tiny crafted OpenAPI document, one schema, no external refs, no network:\n\n    openapi: 3.0.3\n    info: {title: t, version: \"1.0.0\"}\n    paths: {}\n    components:\n      schemas:\n        A:\n          $ref: '#/components/schemas/A/additionalProperties'\n\nAttacker model: any service or tool that loads an untrusted spec via the default openapi3.Loader (LoadFromData / LoadFromFile / LoadFromURI), e.g. a spec registry, an API-management platform ingesting user specs, a linter, or a converter. It crashes during LOAD (ResolveRefsIn), before Validate.\n\nVerification level\n------------------\nEXECUTED with negative controls (agent-run go test at HEAD f0407d5, including yesterday's security merge; the bug is still present). The full stack pins LoadFromData:196 -> ResolveRefsIn:274 -> resolveSchemaRef:1048 -> resolveComponent:485 -> drill:439 -> :455, propagating to main(); no recover() in loader.go/schema.go (grep + trace). Two negative controls stay clean: drilling additionalProperties of a resolved schema loads fine (the existing TestIssue376 happy path), and a normal recursive schema loads fine, so the nil Value is specifically the cause. I independently re-confirmed at HEAD that loader.go:455 dereferences c.Value.AdditionalProperties with no nil-check on c.Value. NOT verified: I did not enumerate every consumer's recover posture.\n\nSuggested fix\n-------------\nAdd if c.Value == nil { break } (fall through to the nil-safe drillIntoField) before touching c.Value.AdditionalProperties. One line.\n\nAlso cleared (stated, not claimed)\n----------------------------------\nThe allOf/anyOf $ref diamond does not blow up: Schema.validate threads its stack through the return and never pops it, acting as a global pointer-keyed visited-set (executed N=10..30, microseconds). External-ref SSRF/path-traversal is blocked by default (IsExternalRefsAllowed=false); the known custom-ReadFromURIFunc bypass is the already-banked downstream oasdiff item.\n\nAdvisory-source note\n--------------------\nFive-source enumeration: every kin-openapi advisory (CVE-2025-30153 plus the five fresh July-2026 GHSAs) is in openapi3filter (request validation); this finding is in the openapi3 loader, untouched by that systematic reporter and flagged un-analyzed by the prior oasdiff scout. Not contested on the loader surface as of today (a systematic hunter could pivot, so it decays; submit reasonably promptly).\n\nDedup\n-----\nDedup gate clean: no kin-openapi loader verdict in COVERED-INDEX, DISCLOSURE-INDEX or SCOUT-EXCLUDE (the one DISCLOSURE-INDEX hit is report #313, the downstream oasdiff, a different repo/lane).\n\nTooling\n-------\nAI assistance was used while investigating. The panic is executed-verified with negative controls (a one-schema self-referential additionalProperties $ref crashes LoadFromData while a resolved additionalProperties and a normal recursive schema load fine), and I confirmed at HEAD that loader.go:455 dereferences c.Value.AdditionalProperties with no nil-check on c.Value, on a load path with no recover.","summary":"The kin-openapi Go library panics with a nil-pointer dereference when its spec loader reads an OpenAPI document whose additionalProperties $ref refers back to itself. An attacker who can supply such a spec can crash the process that loads it, a denial of service.","severity":"medium","cvss":5.3,"epss":0.00372,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/getkin/kin-openapi","fixed":["0.145.0"],"affected":"< 0.145.0","ecosystem":"go"},{"name":"github.com/getkin/kin-openapi","fixed":["0.145.0"],"affected":"<= 0.144.0","ecosystem":"go"}],"ecosystems":["go"],"tags":["cwe-476","go","kin-openapi","openapi","package"],"not_affected_if":["not-using-kin-openapi","trusted-specs-only"],"how_to_check":"- Check the version of `github.com/getkin/kin-openapi` in `go.mod` or `go list -m github.com/getkin/kin-openapi`\n- Look for code that loads OpenAPI specs from untrusted or user-supplied input","fix":"- `github.com/getkin/kin-openapi` `0.145.0`","status":"open","published_at":"2026-10-15T16:17:30+00:00","first_seen_at":"2026-11-06T00:09:05+00:00","triaged_at":"2026-11-06T00:10:38+00:00","updated_at":"2026-11-06T00:19:08+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-06T00:10:38Z","model":"claude-haiku-5-5","output":{"fix":"- `github.com/getkin/kin-openapi` `0.145.0`","reach":"unknown","title":"kin-openapi: crafted spec with self-referencing additionalProperties crashes loader","impact":"low","summary":"The kin-openapi Go library panics with a nil-pointer dereference when its spec loader reads an OpenAPI document whose additionalProperties $ref refers back to itself. An attacker who can supply such a spec can crash the process that loads it, a denial of service.","audience":"developers","category":"package","nicknames":[],"who_cares":["go","openapi","kin-openapi"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Process crashes via nil-pointer panic, causing denial of service","analyst_note":"","how_to_check":"- Check the version of `github.com/getkin/kin-openapi` in `go.mod` or `go list -m github.com/getkin/kin-openapi`\n- Look for code that loads OpenAPI specs from untrusted or user-supplied input","plain_action":"","needs_analyst":false,"not_affected_if":["trusted-specs-only","not-using-kin-openapi"],"who_is_affected":"Applications written in Go that use kin-openapi to parse OpenAPI specifications, especially those that accept specs from users or external sources. Services that only load fixed, trusted specs bundled with the build are much less exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000686,"input_tokens":4244,"output_tokens":524,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-100348':20A,31A '-2025':468C '-2026':19A,27A,30A,475C '-30153':469C '-476':39B '-6789':28A '/additionalproperties':153C '/components/schemas/a/additionalproperties':216C '/getkin/kin-openapi':34A,37A '/schema.go':306C '1.0.0':210C '10':427C '1048':292C '196':288C '274':290C '3.0.3':205C '30':428C '313':553C '439':296C '455':108C,297C '485':294C '4jhx':25A 'access':187C 'act':415C 'add':373C 'additionalproperti':12A,68B,115C,129C,186C,315C,583C,590C 'advisori':455C,466C 'advisory-sourc':454C 'agent':266C 'agent-run':265C 'ai':561C 'allof/anyof':397C 'alreadi':449C 'already-bank':448C 'also':391C 'analyz':498C 'ap':131C,133C,141C 'api':241C 'api-manag':240C 'around':106C 'assist':562C 'attack':75B,191C,217C 'attempt':145C 'back':71B 'bank':450C 'block':435C 'blow':402C 'branch':112C 'break':377C 'bug':279C 'bypass':445C 'c.value':124C,135C,181C,359C,375C,613C 'c.value.additionalproperties':117C,352C,388C,606C 'c.value.additionalproperties.has':132C 'c.value.additionalproperties.schema':144C 'case':110C,125C 'caus':341C 'check':122C,357C,611C 'claim':395C 'clean':313C,527C 'clear':392C 'closur':105C 'compon':212C 'confirm':95C,346C,600C 'consum':367C 'contest':505C 'control':264C,311C,575C 'convert':251C 'could':516C 'cover':536C 'covered-index':535C 'craft':194C 'crash':83B,253C,585C 'cursor':140C,143C 'custom':443C 'custom-readfromurifunc':442C 'cve':18A,29A,467C 'cwe':38B 'decay':520C 'dedup':524C,525C 'default':230C,437C 'defect':94C 'denial':90B 'derefer':58B,116C,351C,605C 'diamond':399C 'differ':558C 'disclosur':539C,548C 'disclosure-index':538C,547C 'document':66B,196C 'dos':17A 'downstream':451C,555C 'drill':104C,151C,295C,314C 'drillintofield':385C 'e.g':235C 'els':142C 'enumer':365C,461C 'everi':366C,462C 'exclud':544C 'execut':261C,425C,571C 'executed-verifi':570C 'exist':323C 'extern':200C,431C 'external-ref':430C 'f0407d5':98C,272C 'f8wq':24A 'fall':378C 'fals':439C 'find':483C 'fine':321C,333C,597C 'five':459C,472C 'five-sourc':458C 'fix':372C 'flag':495C 'fragment':150C 'fresh':473C 'full':284C 'gate':526C 'ghsa':22A 'ghsa-mh7x-f8wq-4jhx':21A 'ghsas':476C 'github.com':33A,36A 'github.com/getkin/kin-openapi':32A,35A 'global':418C 'go':26A,40B,50B,268C 'grep':307C 'happi':325C 'head':97C,271C,348C,602C 'hit':550C 'hunter':515C 'includ':273C 'independ':343C 'index':537C,540C,549C 'info':206C 'ingest':244C 'input':189C 'insid':101C 'investig':566C 'isexternalrefsallow':438C 'item':453C 'juli':474C 'key':421C 'kin':2A,42B,48B,464C,530C 'kin-openapi':1A,41B,47B,463C,529C 'known':441C 'level':260C 'librari':51B 'line':107C,390C 'linter':248C 'load':87B,224C,255C,320C,332C,596C,616C 'loader':5A,62B,488C,508C,532C 'loader.go':305C 'loader.go/schema.go':304C 'loader.go:455':350C,604C 'loadfromdata':232C,287C,586C 'loadfromfil':233C 'loadfromuri':234C 'main':300C 'manag':242C 'merg':277C 'mh7x':23A 'microsecond':429C 'model':218C 'n':426C 'negat':263C,310C,574C 'network':203C 'never':412C 'nil':15A,56B,121C,134C,138C,161C,183C,336C,356C,376C,383C,610C 'nil-check':120C,355C,609C 'nil-point':14A,55B 'nil-saf':382C 'normal':329C,593C 'not-yet-resolv':164C 'note':457C 'oasdiff':452C,502C,556C 'one':197C,389C,546C,578C 'one-schema':577C 'openapi':3A,43B,44B,49B,65B,195C,204C,465C,531C 'openapi3':487C 'openapi3.loader':231C 'openapi3/loader.go':100C 'openapi3filter':479C 'packag':45B 'panic':6A,52B,188C,568C 'path':211C,326C,617C 'pathpart':114C,128C 'pin':286C 'pivot':517C 'platform':243C 'plus':470C 'pointer':16A,57B,420C 'pointer-key':419C 'pop':413C 'postur':370C 'present':282C 'prior':501C 'process':85B 'prompt':523C 'propag':298C 'pure':163C 're':345C 're-confirm':344C 'read':63B 'readfromurifunc':444C 'reason':522C 'recov':302C,369C,620C 'recurs':330C,594C 'ref':13A,69B,149C,168C,201C,215C,398C,432C,584C 'refer':70B,173C 'referenti':11A,582C 'registri':238C 'repo/lane':559C 'report':493C,552C 'request':480C 'resolv':167C,174C,318C,589C 'resolvecompon':102C,293C 'resolverefsin':256C,289C 'resolveschemaref':291C 'return':410C 'run':267C 'safe':384C 'schema':156C,198C,213C,319C,331C,579C,595C 'schema.validate':404C 'schemaref':111C,126C 'scout':503C,543C 'scout-exclud':542C 'secur':276C 'self':10A,172C,581C 'self-refer':171C 'self-referenti':9A,580C 'servic':92B,220C 'set':180C,424C 'sourc':456C,460C 'spec':4A,61B,81B,227C,237C,246C 'specif':339C 'ssrf/path-traversal':433C 'stack':285C,407C 'state':393C 'stay':312C 'still':160C,281C 'submit':521C 'suggest':371C 'suppli':78B 'surfac':509C 'systemat':492C,514C 'test':269C 'testissue376':324C 'thread':405C 'tini':193C 'titl':207C 'today':512C 'tool':222C,560C 'touch':387C 'trace':308C 'true':146C 'two':309C 'un':497C 'un-analyz':496C 'untouch':489C 'untrust':226C 'use':564C 'user':245C 'v0.144.0':99C 'valid':258C,481C 'valu':158C,178C,337C 'verdict':533C 'verif':259C 'verifi':361C,572C 'version':209C 'via':228C 'visit':423C 'visited-set':422C 'whose':67B,157C 'yesterday':274C 'yet':166C","nicknames":[],"mitigations":[],"who_affected":"Applications written in Go that use kin-openapi to parse OpenAPI specifications, especially those that accept specs from users or external sources. Services that only load fixed, trusted specs bundled with the build are much less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["githubcomgetkinkinopenapi"],"ptokens":["com","getkin","github","kin","openapi"],"labels":["cwe476","go","kinopenapi","medium","openapi","package"],"campaign_type":null,"first_public_at":"2026-07-25T12:58:58+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6789","url":"https://pkg.go.dev/vuln/GO-2026-6789","severity":null,"published_at":"2026-11-05T22:53:53+00:00","modified_at":"2026-11-05T22:53:53+00:00","first_seen_at":"2026-11-06T00:09:05+00:00","fetched_at":"2026-11-06T00:09:05+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-100348","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100348","severity":null,"published_at":"2026-10-15T16:17:30+00:00","modified_at":"2026-10-15T16:17:30+00:00","first_seen_at":"2026-11-06T00:19:01+00:00","fetched_at":"2026-11-06T00:19:01+00:00","note":null},{"source":"ghsa","external_id":"GHSA-mh7x-f8wq-4jhx","url":"https://github.com/advisories/GHSA-mh7x-f8wq-4jhx","severity":"medium","published_at":"2026-10-15T20:15:58+00:00","modified_at":"2026-10-15T20:16:00+00:00","first_seen_at":"2026-11-06T00:19:08+00:00","fetched_at":"2026-11-06T00:19:08+00:00","note":null}],"documents":[{"id":81803,"url":"https://github.com/getkin/kin-openapi/commit/88aa64c7cbd03ecadbb419c473bdcaa8b0124c6b","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":81804,"url":"https://github.com/getkin/kin-openapi/releases/tag/v0.145.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":81805,"url":"https://github.com/getkin/kin-openapi/security/advisories/GHSA-mh7x-f8wq-4jhx","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-25T12:58:58+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":81950,"url":"https://api.github.com/repos/getkin/kin-openapi/security-advisories/GHSA-mh7x-f8wq-4jhx","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"}],"exploit_sources":[{"type":"epss","score":0.00372,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100348"}],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}