---
id: "CVE-2026-100348"
page: "https://infrastack.ai/live/CVE-2026-100348"
kind: "vulnerability"
aliases: ["CVE-2026-100348", "GHSA-mh7x-f8wq-4jhx", "GO-2026-6789"]
title: "kin-openapi spec loader panics on a self-referential additionalProperties $ref (nil-pointer DoS)"
severity: "medium"
cvss: 5.3
epss: 0.00372
exploited: false
status: "open"
category: "package"
products: [{"name": "github.com/getkin/kin-openapi", "fixed": ["0.145.0"], "affected": "< 0.145.0", "ecosystem": "go"}, {"name": "github.com/getkin/kin-openapi", "fixed": ["0.145.0"], "affected": "<= 0.144.0", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["cwe-476", "go", "kin-openapi", "openapi", "package"]
not_affected_if: ["not-using-kin-openapi", "trusted-specs-only"]
published_at: "2026-10-15T16:17:30+00:00"
first_seen_at: "2026-11-06T00:09:05+00:00"
updated_at: "2026-11-06T00:19:08+00:00"
sources: [{"source": "govuln", "url": "https://pkg.go.dev/vuln/GO-2026-6789", "first_seen_at": "2026-11-06T00:09:05+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100348", "first_seen_at": "2026-11-06T00:19:01+00:00"}, {"source": "ghsa", "url": "https://github.com/advisories/GHSA-mh7x-f8wq-4jhx", "first_seen_at": "2026-11-06T00:19:08+00:00"}]
exploit_sources: [{"type": "epss", "score": 0.00372, "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-100348"}]
---

# kin-openapi spec loader panics on a self-referential additionalProperties $ref (nil-pointer DoS)

Link for people: https://infrastack.ai/live/CVE-2026-100348 (this .md is for agents)

The kin-openapi Go library panics with a nil-pointer dereference when its spec loader reads an OpenAPI document whose additionalProperties $ref refers back to itself. An attacker who can supply such a spec can crash the process that loads it, a denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/getkin/kin-openapi affected < 0.145.0 fixed 0.145.0
- go:github.com/getkin/kin-openapi affected <= 0.144.0 fixed 0.145.0

## How to check

- Check the version of `github.com/getkin/kin-openapi` in `go.mod` or `go list -m github.com/getkin/kin-openapi`
- Look for code that loads OpenAPI specs from untrusted or user-supplied input

## Fix

- `github.com/getkin/kin-openapi` `0.145.0`

## Timeline

- 2026-11-06T00:09:05+00:00 govuln https://pkg.go.dev/vuln/GO-2026-6789
- 2026-11-06T00:19:01+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-100348
- 2026-11-06T00:19:08+00:00 ghsa https://github.com/advisories/GHSA-mh7x-f8wq-4jhx

## Documents

- [advisory] Vendor advisory: github.com https://github.com/getkin/kin-openapi/security/advisories/GHSA-mh7x-f8wq-4jhx
- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/getkin/kin-openapi/security-advisories/GHSA-mh7x-f8wq-4jhx
- [fix] Patch: github.com https://github.com/getkin/kin-openapi/commit/88aa64c7cbd03ecadbb419c473bdcaa8b0124c6b
- [fix] Release notes: github.com https://github.com/getkin/kin-openapi/releases/tag/v0.145.0

## From the sources

The defect
----------
Confirmed at HEAD (f0407d5, v0.144.0). openapi3/loader.go, inside resolveComponent's drill closure (around line 455), the case *SchemaRef branch for pathPart == "additionalProperties" dereferences c.Value.AdditionalProperties with no nil-check on c.Value:

    case *SchemaRef:
        if pathPart == "additionalProperties" {
            if ap := c.Value.AdditionalProperties.Has; ap != nil {   // c.Value can be nil here
                cursor = *ap
            } else {
                cursor = c.Value.AdditionalProperties.Schema
            }
            attempted = true
        }

When a $ref fragment drills through .../additionalProperties of a schema whose Value is still nil (a pure, not-yet-resolved $ref, or a self-reference resolved before its own Value is set), c.Value is nil and the .AdditionalProperties access panics.

Input and attacker
-------------------
A tiny crafted OpenAPI document, one schema, no external refs, no network:

    openapi: 3.0.3
    info: {title: t, version: "1.0.0"}
    paths: {}
    components:
      schemas:
        A:
          $ref: '#/components/schemas/A/additionalProperties'

Attacker model: any service or tool that loads an untrusted spec via the default openapi3.Loader (LoadFromData / LoadFromFile / LoadFromURI), e.g. a spec registry, an API-management platform ingesting user specs, a linter, or a converter. It crashes during LOAD (ResolveRefsIn), before Validate.

Verification level
------------------
EXECUTED with negative controls (agent-run go test at HEAD f0407d5, including yesterday's security merge; the bug is still present). The full stack pins LoadFromData:196 -> ResolveRefsIn:274 -> resolveSchemaRef:1048 -> resolveComponent:485 -> drill:439 -> :455, propagating to main(); no recover() in loader.go/schema.go (grep + trace). Two negative controls stay clean: drilling additionalProperties of a resolved schema loads fine (the existing TestIssue376 happy path), and a normal recursive schema loads fine, so the nil Value is specifically the cause. I independently re-confirmed at HEAD that loader.go:455 dereferences c.Value.AdditionalProperties with no nil-check on c.Value. NOT verified: I did not enumerate every consumer's recover posture.

Suggested fix
-------------
Add if c.Value == nil { break } (fall through to the nil-safe drillIntoField) before touching c.Value.AdditionalProperties. One line.

Also cleared (stated, not claimed)
----------------------------------
The allOf/anyOf $ref diamond does not blow up: Schema.validate threads its stack through the return and never pops it, acting as a global pointer-keyed visited-set (executed N=10..30, microseconds). External-ref SSRF/path-traversal is blocked by default (IsExternalRefsAllowed=false); the known custom-ReadFromURIFunc bypass is the already-banked downstream oasdiff item.

Advisory-source note
--------------------
Five-source enumeration: every kin-openapi advisory (CVE-2025-30153 plus the five fresh July-2026 GHSAs) is in openapi3filter (request validation); this finding is in the openapi3 loader, untouched by that systematic reporter and flagged un-analyzed by the prior oasdiff scout. Not contested on the loader surface as of today (a systematic hunter could pivot, so it decays; submit reasonably promptly).

Dedup
-----
Dedup gate clean: no kin-openapi loader verdict in COVERED-INDEX, DISCLOSURE-INDEX or SCOUT-EXCLUDE (the one DISCLOSURE-INDEX hit is report #313, the downstream oasdiff, a different repo/lane).

Tooling
-------
AI assistance was used while investigating. The panic is executed-verified with negative controls (a one-schema self-referential additionalProperties $ref crashes LoadFromData while a resolved additionalProperties and a normal recursive schema load fine), and I confirmed at HEAD that loader.go:455 dereferences c.Value.AdditionalProperties with no nil-check on c.Value, on a load path with no recover.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_