{"id":"CVE-2026-100352","kind":"vulnerability","aliases":["CVE-2026-100352","GHSA-rj39-cv6w-8wv7","GO-2026-6795"],"related":[],"title":"kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path","description":"## Summary\n\nkin-openapi guards against `NaN` and `Inf` values in its built-in schema visitor (`visitJSON`) by returning `ErrSchemaInputNaN` / `ErrSchemaInputInf` when a `float64` input violates those constraints. For OAS 3.1 specs, however, `Schema.VisitJSON` routes through `useJSONSchema2020`, which hands the value directly to `santhosh-tekuri/jsonschema/v6` v6.0.2 without applying the same guard.\n\nInside `jsonschema/v6` v6.0.2, `numValidate` builds a `*big.Rat` from the input via `big.Rat.SetString(fmt.Sprintf(\"%v\", v))`. For `NaN`/`Inf` this parse fails silently and returns `nil`. `numValidate` then dereferences the nil `*big.Rat` (in `math/big.(*Rat).Cmp`), producing a Go runtime panic.\n\nAn attacker delivers this by sending an HTTP request with `Content-Type: application/yaml` (or `application/x-yaml`) and a YAML body containing `.nan`, `.inf`, or `-.inf`. The `YamlBodyDecoder` decodes those tokens into `math.NaN()` / `math.Inf(±1)` (standard YAML 1.2 behavior), and they propagate to the unguarded `useJSONSchema2020` path whenever the schema declares a numeric constraint (`minimum`, `maximum`, `exclusiveMinimum`, `exclusiveMaximum`, or `multipleOf`).\n\n## Details\n### Root Cause\n\nThe built-in visitor `visitJSON` at `openapi3/schema.go:1968` guards NaN/Inf explicitly:\n\n```go\ncase float64:\n    if math.IsNaN(value) {\n        return ErrSchemaInputNaN\n    }\n    if math.IsInf(value, 0) {\n        return ErrSchemaInputInf\n    }\n```\n\nFor OAS 3.1 specs, `VisitJSON` dispatches to `useJSONSchema2020` (`openapi3/schema_jsonschema_validator.go:204`), which contains no such guard:\n\n```go\nfunc (schema *Schema) useJSONSchema2020(settings *schemaValidationSettings, value any) error {\n    validator, err := newJSONSchemaValidator(schema)\n    if err != nil {\n        return schema.visitJSON(settings, value)\n    }\n    return validator.validate(value)      // value handed straight through\n}\n```\n\n`jsonSchemaValidator.validate` calls `jsonschema/v6.Schema.Validate` (line 146), which reaches `numValidate` in v6.0.2. There, `big.Rat.SetString(fmt.Sprintf(\"%v\", v))` returns `(nil, false)` for `NaN`/`Inf`, and the code dereferences the `nil` `*big.Rat` in `Rat.Cmp`, causing the panic.\n\n## Proof of Concept\n\n### Environment\n\n- kin-openapi v0.144.0 (tag `v0.144.0`, commit `f0407d5`)\n- santhosh-tekuri/jsonschema/v6 v6.0.2 (transitive dep)\n- Go 1.26.7\n\n### Spec\n\nMinimal OAS 3.1 spec (`spec.yaml`) declaring a YAML body with a numeric constraint:\n\n```yaml\nopenapi: '3.1.0'\ninfo: { title: Test, version: '1.0' }\npaths:\n  /test:\n    post:\n      requestBody:\n        required: true\n        content:\n          application/yaml:\n            schema:\n              type: number\n              minimum: 0\n      responses:\n        '200': { description: OK }\n```\n\n### Trigger\n\nA single `POST /test` with `Content-Type: application/yaml` and body `.nan`, `.inf`, or `-.inf`. All three variants panic:\n\n```\n=== RUN   TestNaNInf\n[nan]    PANIC (confirms vuln): runtime error: invalid memory address or nil pointer dereference\n[inf]    PANIC (confirms vuln): runtime error: invalid memory address or nil pointer dereference\n[neginf] PANIC (confirms vuln): runtime error: invalid memory address or nil pointer dereference\n```\n\n### Panic stack trace (confirms exact chain)\n\n```\npanic: runtime error: invalid memory address or nil pointer dereference\n\nmath/big.(*Rat).Cmp(0x0, ...)                                       <- nil *big.Rat dereferenced\n    C:/Program Files/Go/src/math/big/rat.go:492\ngithub.com/santhosh-tekuri/jsonschema/v6.(*validator).numValidate(...)\n    .../jsonschema/v6@v6.0.2/validator.go:525\ngithub.com/santhosh-tekuri/jsonschema/v6.(*validator).validate(...)\n    .../jsonschema/v6@v6.0.2/validator.go:168\ngithub.com/santhosh-tekuri/jsonschema/v6.(*Schema).validate(...)\n    .../jsonschema/v6@v6.0.2/validator.go:34\ngithub.com/getkin/kin-openapi/openapi3.(*jsonSchemaValidator).validate(...)\n    openapi3/schema_jsonschema_validator.go:146\ngithub.com/getkin/kin-openapi/openapi3.(*Schema).useJSONSchema2020(...)   <- MISSING NaN/Inf guard\n    openapi3/schema_jsonschema_validator.go:211\ngithub.com/getkin/kin-openapi/openapi3.(*Schema).VisitJSON(...)\n    openapi3/schema.go:1946\ngithub.com/getkin/kin-openapi/openapi3filter.ValidateRequestBody(...)\n    openapi3filter/validate_request.go:364\ngithub.com/getkin/kin-openapi/openapi3filter.ValidateRequest(...)\n    openapi3filter/validate_request.go:96\n```\n\n### net/http behavior (severity nuance)\n\nBehind a standard `net/http` server, the panic is recovered per-connection. The client sees a dropped connection; the server process continues:\n\n```\nSending POST /test body=.nan against real net/http server...\n2026/08/25 http: panic serving 127.0.0.1:40625: runtime error: invalid memory address or nil pointer dereference\nCLIENT ERROR (connection dropped): Post \".../test\": EOF\nProcess still alive after request: true\n```\n\nThis is a **recoverable panic**, unlike the recursion finding. `recover()` catches it (verified by capturing the panic value in a `defer` in the same goroutine). Non-`net/http` hosts or validation performed in an application-spawned goroutine are not covered by that recovery and would experience a full-process crash.\n\n### Fix verification\n\nUpgrading only the transitive dependency to `jsonschema/v6@v6.0.3` (via `go get github.com/santhosh-tekuri/jsonschema/v6@v6.0.3`) eliminates the panic entirely; all three payloads return a clean validation error:\n\n```\n[nan]    Returned normally, err = request body has an error: doesn't match schema: validation failed due to: at '': invalid jsonType float64\n[inf]    Returned normally, err = request body has an error: doesn't match schema: validation failed due to: at '': invalid jsonType float64\n[neginf] Returned normally, err = request body has an error: doesn't match schema: validation failed due to: at '': invalid jsonType float64\n```\n\nThis confirms the upstream `jsonschema/v6` v6.0.3 release treats the NaN/Inf case as a bug and fixes it at the source. It also confirms `useJSONSchema2020` is the reachable path: patching only the transitive dep removes the panic without touching kin-openapi code.\n\n## Why This Is a Vulnerability, Not by Design\n\n- The library explicitly refuses NaN/Inf in its own visitor (`ErrSchemaInputNaN` / `ErrSchemaInputInf` at `schema.go:1968`). The stated policy is: these values are not allowed.\n- The OAS 3.1 dispatch (`useJSONSchema2020`) simply omits the same guard — a coding gap, not a design decision.\n- Upstream `jsonschema/v6` v6.0.3 fixes the same case as a bug. Two independent code owners agree it should not panic.\n- The trigger is a single HTTP request body an unauthenticated client can send. There is no legitimate content-authoring reason to submit `.nan` / `.inf` as a numeric field.\n\n## Impact\n\n- **Per-request denial of service (net/http hosts).** Every crafted request kills its own connection with zero attacker cost. Sustained flooding degrades service reliability and log noise.\n- **Full-process denial of service (non-net/http hosts or goroutine-spawned validation).** No `net/http` recovery wrapper is present; the whole process crashes on a single request.\n- **Attack surface is any OAS 3.1 API that accepts YAML bodies with numeric constraints.** These constraints (`minimum`, `maximum`, `exclusiveMinimum`, `exclusiveMaximum`, `multipleOf`) are common on any numeric field with a range.","summary":"kin-openapi, a Go library for parsing and validating OpenAPI specs, accepts YAML NaN and Inf values that skip its built-in checks on the OAS 3.1 validation path. Feeding such a spec can cause a panic that crashes the program using the library.","severity":"high","cvss":7.5,"epss":0.00595,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/getkin/kin-openapi","fixed":["0.148.0"],"affected":"< 0.148.0","ecosystem":"go"}],"ecosystems":["go"],"tags":["cwe-754","go","kin-openapi","openapi","package"],"not_affected_if":["not-oas-3.1","trusted-input-only"],"how_to_check":"- Run `go list -m github.com/getkin/kin-openapi` in the project to see the version in use.\n- Check whether the version is below `0.148.0`.","fix":"- `github.com/getkin/kin-openapi` `0.148.0`","status":"open","published_at":"2026-10-15T16:17:31+00:00","first_seen_at":"2026-11-06T00:09:05+00:00","triaged_at":"2026-11-06T00:10:38+00:00","updated_at":"2026-11-06T00:19:08+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-06T00:10:38Z","model":"claude-haiku-5-5","output":{"fix":"- `github.com/getkin/kin-openapi` `0.148.0`","reach":"unknown","title":"kin-openapi: YAML NaN and Inf values bypass guards and panic validation","impact":"low","summary":"kin-openapi, a Go library for parsing and validating OpenAPI specs, accepts YAML NaN and Inf values that skip its built-in checks on the OAS 3.1 validation path. Feeding such a spec can cause a panic that crashes the program using the library.","audience":"developers","category":"package","nicknames":[],"who_cares":["go","kin-openapi","openapi"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"crafted YAML crashes the process via panic","analyst_note":"","how_to_check":"- Run `go list -m github.com/getkin/kin-openapi` in the project to see the version in use.\n- Check whether the version is below `0.148.0`.","plain_action":"","needs_analyst":false,"not_affected_if":["trusted-input-only","not-oas-3.1"],"who_is_affected":"Applications written in Go that use kin-openapi to load or validate OpenAPI 3.1 documents from untrusted sources are exposed. Services that only process fixed, trusted specs or do not use the OAS 3.1 validation path can skip it. The sources do not describe a code execution path.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000682,"input_tokens":4263,"output_tokens":512,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-100352':21A,32A '-2026':20A,28A,31A '-6795':29A '-754':37B '/getkin/kin-openapi':35A '/getkin/kin-openapi/openapi3.(*jsonschemavalidator).validate(...)':516C '/getkin/kin-openapi/openapi3.(*schema':521C '/jsonschema/v6':137C,363C,499C,505C,511C '/program':493C '/santhosh-tekuri/jsonschema/v6.(*schema).validate(...)':510C '/santhosh-tekuri/jsonschema/v6.(*validator).numvalidate(...)':498C '/santhosh-tekuri/jsonschema/v6.(*validator).validate(...)':504C '/test':392C,412C '0':269C,403C '0x0':488C '1':217C '1.0':390C '1.2':220C '1.26.7':368C '146':319C,518C '168':507C '1968':254C '200':405C '204':281C '3.1':16A,72B,121C,274C,372C '3.1.0':385C '34':513C '492':495C '525':501C '8wv7':26A 'accept':56B 'address':438C,451C,464C,480C 'appli':140C 'application/x-yaml':199C 'application/yaml':197C,398C,417C 'attack':185C 'behavior':221C 'big.rat':150C,174C,342C,490C 'big.rat.setstring':155C,326C 'bodi':203C,378C,419C 'build':148C 'built':9A,66B,103C,248C 'built-in':8A,65B,102C,247C 'bypass':7A 'c':492C 'call':316C 'case':259C 'caus':80B,245C,345C 'chain':474C 'check':68B 'cmp':178C,487C 'code':338C 'commit':358C 'concept':350C 'confirm':432C,445C,458C,472C 'constraint':118C,236C,382C 'contain':204C,283C 'content':195C,397C,415C 'content-typ':194C,414C 'crash':84B 'cv6w':25A 'cve':19A,30A 'cwe':36B 'declar':233C,375C 'decod':211C 'deliv':186C 'dep':366C 'derefer':171C,339C,442C,455C,468C,484C 'dereferenc':491C 'descript':406C 'detail':243C 'direct':132C 'dispatch':277C 'environ':351C 'err':298C,302C 'error':296C,435C,448C,461C,477C 'errschemainputinf':111C,271C 'errschemainputnan':110C,265C 'exact':473C 'exclusivemaximum':240C 'exclusiveminimum':239C 'explicit':257C 'f0407d5':359C 'fail':164C 'fals':332C 'feed':75B 'files/go/src/math/big/rat.go':494C 'float64':114C,260C 'fmt.sprintf':156C,327C 'func':288C 'ghsa':23A 'ghsa-rj39-cv6w-8wv7':22A 'github.com':34A,497C,503C,509C,515C,520C 'github.com/getkin/kin-openapi':33A 'github.com/getkin/kin-openapi/openapi3.(*jsonschemavalidator).validate(...)':514C 'github.com/getkin/kin-openapi/openapi3.(*schema':519C 'github.com/santhosh-tekuri/jsonschema/v6.(*schema).validate(...)':508C 'github.com/santhosh-tekuri/jsonschema/v6.(*validator).numvalidate(...)':496C 'github.com/santhosh-tekuri/jsonschema/v6.(*validator).validate(...)':502C 'go':27A,38B,48B,181C,258C,287C,367C 'guard':11A,94C,143C,255C,286C 'hand':129C,312C 'howev':123C 'http':191C 'inf':60B,98C,161C,206C,208C,335C,421C,423C,443C 'info':386C 'input':115C,153C 'insid':144C 'invalid':436C,449C,462C,478C 'jsonschema/v6':145C 'jsonschema/v6.schema.validate':317C 'jsonschemavalidator.validate':315C 'kin':2A,40B,45B,92C,353C 'kin-openapi':1A,39B,44B,91C,352C 'librari':49B,89B 'line':318C 'math.inf':216C 'math.isinf':267C 'math.isnan':262C 'math.nan':215C 'math/big':176C,485C 'maximum':238C 'memori':437C,450C,463C,479C 'minim':370C 'minimum':237C,402C 'multipleof':242C 'nan':58B,96C,160C,205C,334C,420C,430C 'nan/inf':5A,256C 'neginf':456C 'newjsonschemavalid':299C 'nil':168C,173C,303C,331C,341C,440C,453C,466C,482C,489C 'number':401C 'numer':235C,381C 'numvalid':147C,169C,322C 'oa':15A,71B,120C,273C,371C 'ok':407C 'openapi':3A,41B,42B,46B,54B,93C,354C,384C 'openapi3/schema.go':253C 'openapi3/schema_jsonschema_validator.go':280C,517C 'packag':43B 'panic':13A,82B,183C,347C,427C,431C,444C,457C,469C,475C 'pars':51B,163C 'path':18A,74B,229C,391C 'pointer':441C,454C,467C,483C 'post':393C,411C 'produc':179C 'program':86B 'proof':348C 'propag':224C 'rat':177C,486C 'rat.cmp':344C 'reach':321C 'request':192C 'requestbodi':394C 'requir':395C 'respons':404C 'return':109C,167C,264C,270C,304C,308C,330C 'rj39':24A 'root':244C 'rout':125C 'run':428C 'runtim':182C,434C,447C,460C,476C 'santhosh':135C,361C 'santhosh-tekuri':134C,360C 'schema':105C,232C,289C,290C,300C,399C 'schema.visitjson':124C,305C 'schemavalidationset':293C 'send':189C 'set':292C,306C 'silent':165C 'singl':410C 'skip':63B 'spec':55B,78B,122C,275C,369C,373C 'spec.yaml':374C 'stack':470C 'standard':218C 'straight':313C 'summari':90C 'tag':356C 'tekuri':136C,362C 'test':388C 'testnaninf':429C 'three':425C 'titl':387C 'token':213C 'trace':471C 'transit':365C 'trigger':408C 'true':396C 'type':196C,400C,416C 'unguard':227C 'use':87B 'usejsonschema2020':127C,228C,279C,291C 'v':157C,158C,328C,329C 'v0.144.0':355C,357C 'v6.0.2':138C,146C,324C,364C 'v6.0.2/validator.go':500C,506C,512C 'valid':17A,53B,73B,297C 'validator.validate':309C 'valu':6A,61B,99C,131C,263C,268C,294C,307C,310C,311C 'variant':426C 'version':389C 'via':14A,154C 'violat':116C 'visitjson':107C,251C,276C 'visitor':106C,250C 'vuln':433C,446C,459C 'whenev':230C 'without':139C 'yaml':4A,57B,202C,219C,377C,383C 'yamlbodydecod':210C","nicknames":[],"mitigations":[],"who_affected":"Applications written in Go that use kin-openapi to load or validate OpenAPI 3.1 documents from untrusted sources are exposed. Services that only process fixed, trusted specs or do not use the OAS 3.1 validation path can skip it. The sources do not describe a code execution path.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["githubcomgetkinkinopenapi"],"ptokens":["com","getkin","github","kin","openapi"],"labels":["cwe754","go","high","kinopenapi","openapi","package"],"campaign_type":null,"first_public_at":"2026-08-27T10:16:27+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6795","url":"https://pkg.go.dev/vuln/GO-2026-6795","severity":null,"published_at":"2026-11-05T22:53:53+00:00","modified_at":"2026-11-05T22:53:53+00:00","first_seen_at":"2026-11-06T00:09:05+00:00","fetched_at":"2026-11-06T00:09:05+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-100352","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100352","severity":null,"published_at":"2026-10-15T16:17:31+00:00","modified_at":"2026-10-20T03:17:11+00:00","first_seen_at":"2026-11-06T00:19:01+00:00","fetched_at":"2026-11-06T00:19:01+00:00","note":null},{"source":"ghsa","external_id":"GHSA-rj39-cv6w-8wv7","url":"https://github.com/advisories/GHSA-rj39-cv6w-8wv7","severity":"high","published_at":"2026-10-15T20:20:27+00:00","modified_at":"2026-10-15T20:20:28+00:00","first_seen_at":"2026-11-06T00:19:08+00:00","fetched_at":"2026-11-06T00:19:08+00:00","note":null}],"documents":[{"id":81796,"url":"https://github.com/getkin/kin-openapi/commit/4487f198ab8be0c37d6ca72c54f5dca4dc25270e","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":81797,"url":"https://github.com/getkin/kin-openapi/releases/tag/v0.148.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":81798,"url":"https://github.com/getkin/kin-openapi/security/advisories/GHSA-rj39-cv6w-8wv7","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-08-27T10:16:27+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":81958,"url":"https://api.github.com/repos/getkin/kin-openapi/security-advisories/GHSA-rj39-cv6w-8wv7","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"}],"exploit_sources":[{"type":"epss","score":0.00595,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100352"}],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}