{"id":"CVE-2026-100350","revision":"a428b2098de14449b370623433bca0bb","records":[{"revision":"a428b2098de14449b370623433bca0bb","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-100350","aliases":[],"title":"kin-openapi deepObject query decoding repeatedly compiles an invariant regular expression","description":"kin-openapi is a Go project for handling OpenAPI files. From 0.145.0 until 0.146.0, openapi3filter repeatedly calls regexp.MustCompile for the same parameter-name regular expression inside the per-query-key loop in urlValuesDecoder.DecodeObject used to decode a deepObject query parameter. An unauthenticated remote client can send an affected endpoint a request containing many unrelated query keys, causing ValidateRequest to perform work and allocations proportional to the attacker-controlled key count for every deepObject parameter. The expression itself is fixed and this is not regular expression denial of service; the resource consumption comes from loop-invariant recompilation. This issue is fixed in version 0.146.0.","state":0,"publishedAt":"2026-10-15T15:37:19.077+00:00","modifiedAt":"2026-10-15T18:32:57.402+00:00","affected":[{"ecosystem":"Vendor product","name":"kin-openapi","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"getkin\",\n                    \"product\": \"kin-openapi\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 0.145.0, < 0.146.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":5.3,"severity":"MEDIUM"}],"references":["https://github.com/getkin/kin-openapi/security/advisories/GHSA-h4r5-mxv5-8mjc","https://github.com/getkin/kin-openapi/commit/d090e36b2f1c42c898ba2a687a8f6e25f5ca727f","https://github.com/getkin/kin-openapi/releases/tag/v0.146.0"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-100350","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-100350","identifiers":["CVE-2026-100350"]},"retained":false,"historicalAffected":[]}],"coverage":[]}