{"id":"EUVD-2026-102158","enisaUuid":"88fa9c73-a090-38b6-9f5e-094fd5d963f3","description":"kin-openapi is a Go project for handling OpenAPI files. From 0.145.0 until 0.146.0, openapi3filter repeatedly calls regexp.MustCompile for the same parameter-name regular expression inside the per-query-key loop in urlValuesDecoder.DecodeObject used to decode a deepObject query parameter. An unauthenticated remote client can send an affected endpoint a request containing many unrelated query keys, causing ValidateRequest to perform work and allocations proportional to the attacker-controlled key count for every deepObject parameter. The expression itself is fixed and this is not regular expression denial of service; the resource consumption comes from loop-invariant recompilation. This issue is fixed in version 0.146.0.","datePublished":"Oct 15, 2026, 3:37:19 PM","dateUpdated":"Oct 15, 2026, 6:32:57 PM","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","references":"https://github.com/getkin/kin-openapi/security/advisories/GHSA-h4r5-mxv5-8mjc\nhttps://github.com/getkin/kin-openapi/commit/d090e36b2f1c42c898ba2a687a8f6e25f5ca727f\nhttps://github.com/getkin/kin-openapi/releases/tag/v0.146.0\n","aliases":"CVE-2026-100350\nGHSA-h4r5-mxv5-8mjc\n","assigner":"GitHub_M","epss":0.45,"enisaIdProduct":[{"id":"5c151005-a46f-363c-bd76-7039781e4fab","product":{"name":"kin-openapi","vendor":{"name":"getkin"}},"product_version":"0.145.0, \u003c 0.146.0"}],"enisaIdVendor":[{"id":"20e978b2-4992-3243-ac90-037ced7bfe8b","vendor":{"name":"getkin"}}],"enisaIdVulnerability":[{"id":"1cf8b201-859c-3a14-bc6e-b30167ad22a3","vulnerability":{"id":"CVE-2026-100350","description":"kin-openapi is a Go project for handling OpenAPI files. From 0.145.0 until 0.146.0, openapi3filter repeatedly calls regexp.MustCompile for the same parameter-name regular expression inside the per-query-key loop in urlValuesDecoder.DecodeObject used to decode a deepObject query parameter. An unauthenticated remote client can send an affected endpoint a request containing many unrelated query keys, causing ValidateRequest to perform work and allocations proportional to the attacker-controlled key count for every deepObject parameter. The expression itself is fixed and this is not regular expression denial of service; the resource consumption comes from loop-invariant recompilation. This issue is fixed in version 0.146.0.","datePublished":"Oct 15, 2026, 3:37:19 PM","dateUpdated":"Oct 15, 2026, 6:32:57 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","references":"https://github.com/getkin/kin-openapi/security/advisories/GHSA-h4r5-mxv5-8mjc\nhttps://github.com/getkin/kin-openapi/commit/d090e36b2f1c42c898ba2a687a8f6e25f5ca727f\nhttps://github.com/getkin/kin-openapi/releases/tag/v0.146.0\n","enisa_id":"EUVD-2026-102158\n","assigner":"GitHub_M","epss":0.45,"dataProcessed":"Nov 4, 2026, 7:14:50 AM","vulnerabilityProduct":[{"id":"89563b5c-e781-3469-9fc4-4db33600eef9","product":{"name":"kin-openapi","vendor":{"name":"getkin"}},"product_version":"0.145.0, \u003c 0.146.0"}],"vulnerabilityVendor":[{"id":"e1e12091-9349-3050-9f62-141674bf3be8","vendor":{"name":"getkin"}}]}},{"id":"5618c7e5-e7a7-3059-b32a-ac6a84575190","vulnerability":{"id":"GHSA-h4r5-mxv5-8mjc","description":"kin-openapi deepObject query decoding repeatedly compiles an invariant regular expression","datePublished":"Oct 15, 2026, 8:18:15 PM","dateUpdated":"Oct 15, 2026, 8:18:16 PM","baseScore":0.0,"references":"https://github.com/getkin/kin-openapi/security/advisories/GHSA-h4r5-mxv5-8mjc\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-100350\nhttps://github.com/getkin/kin-openapi/commit/d090e36b2f1c42c898ba2a687a8f6e25f5ca727f\nhttps://github.com/getkin/kin-openapi\nhttps://github.com/getkin/kin-openapi/releases/tag/v0.146.0\n","enisa_id":"EUVD-2026-102158\n","aliases":"GHSA-h4r5-mxv5-8mjc\nCVE-2026-100350\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:48 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"1cff9500-e999-3947-ac73-b77c17308d9c","advisory":{"id":"openSUSE-SU-2026:12164-1","description":"hugo-0.168.0-2.1 on GA media","summary":"hugo-0.168.0-2.1 on GA media","datePublished":"Oct 17, 2026, 12:00:00 AM","dateUpdated":"Oct 18, 2026, 10:27:41 AM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_12164-1.json\nhttps://www.suse.com/security/cve/CVE-2026-100347/\nhttps://www.suse.com/security/cve/CVE-2026-100348/\nhttps://www.suse.com/security/cve/CVE-2026-100349/\nhttps://www.suse.com/security/cve/CVE-2026-100350/\nhttps://www.suse.com/security/cve/CVE-2026-100351/\nhttps://www.suse.com/security/cve/CVE-2026-100352/\n","aliases":"CVE-2026-100347\nCVE-2026-100348\nCVE-2026-100349\nCVE-2026-100350\nCVE-2026-100351\nCVE-2026-100352\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"0e391701-ba76-3fef-b408-044aed9ab21e","product":{"name":"hugo-zsh-completion-0:0.168.0-2.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"15961777-7bf4-3dab-8d62-6722e72f64b4","product":{"name":"hugo-bash-completion-0:0.168.0-2.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"1725178b-76ef-3065-ae60-74ef0db9e100","product":{"name":"hugo-zsh-completion-0:0.168.0-2.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"1a0d67d9-3027-3f35-89ee-8260acb32af4","product":{"name":"openSUSE Tumbleweed","vendor":{"name":"SUSE"}}},{"id":"36673632-aed2-3a9d-84b1-658579db3fb1","product":{"name":"hugo-bash-completion-0:0.168.0-2.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"46b34a85-1ffd-36f6-b889-e0c7d78fdc74","product":{"name":"hugo-zsh-completion-0:0.168.0-2.1.s390x","vendor":{"name":"SUSE"}}},{"id":"53a89638-469e-38ea-bf8f-cbe1cec5b8fc","product":{"name":"hugo-bash-completion-0:0.168.0-2.1.s390x","vendor":{"name":"SUSE"}}},{"id":"54dfb111-c7ad-32bb-aaf7-3e0cb05d5d34","product":{"name":"hugo-0:0.168.0-2.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"64c3513c-b761-3b6e-93a5-5cbb6da5cf45","product":{"name":"hugo-0:0.168.0-2.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"7ea5f117-ac48-3f02-bc1b-6b7c6fa770b4","product":{"name":"hugo-0:0.168.0-2.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"a2e89ddf-8df9-35d1-9b39-1155a65fc833","product":{"name":"hugo-0:0.168.0-2.1.s390x","vendor":{"name":"SUSE"}}},{"id":"cca5d804-5d66-353a-92db-0d0068da432d","product":{"name":"hugo-zsh-completion-0:0.168.0-2.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"db311cf5-f48b-32f8-9d4b-0d271f4683c2","product":{"name":"hugo-bash-completion-0:0.168.0-2.1.ppc64le","vendor":{"name":"SUSE"}}}]}},{"id":"ab35b2bb-7049-35ac-93be-bf029aaa96a4","advisory":{"id":"RHSA-2026:76677","description":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","summary":"An update for Red Hat Hardened Images RPMs is now available.","datePublished":"Oct 6, 2026, 8:26:00 AM","dateUpdated":"Nov 4, 2026, 12:15:18 AM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:76677\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_76677.json\n","aliases":"CVE-2024-24786\nCVE-2026-56851\nCVE-2026-61801\nCVE-2026-95502\nCVE-2026-97394\nCVE-2026-100347\nCVE-2026-100348\nCVE-2026-100349\nCVE-2026-100350\nCVE-2026-100351\nCVE-2026-101899\nCVE-2026-109855\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"335287a7-ced4-3080-b1ad-2e6235bafb6e","product":{"name":"Red Hat Hardened Images","vendor":{"name":"Red Hat"}}},{"id":"51b55ba2-f5d3-34ff-b412-1563b7f7b0b4","product":{"name":"grafana12.4-0:12.4.12-0.4.hum1@src","vendor":{"name":"Red Hat"}}},{"id":"63f37ffb-218f-312e-b209-a77eda41aef4","product":{"name":"grafana12.4-0:12.4.12-0.4.hum1@x86_64","vendor":{"name":"Red Hat"}}},{"id":"f76f70aa-ccdd-3070-90c3-fd71da797c14","product":{"name":"grafana12.4-0:12.4.12-0.4.hum1@aarch64","vendor":{"name":"Red Hat"}}}]}},{"id":"b2d81501-6480-3d77-953c-aa944d93eca9","advisory":{"id":"RHSA-2026:82637","description":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","summary":"An update for Red Hat Hardened Images RPMs is now available.","datePublished":"Oct 14, 2026, 12:21:37 AM","dateUpdated":"Oct 30, 2026, 1:56:17 PM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:82637\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_82637.json\n","aliases":"CVE-2026-97394\nCVE-2026-100347\nCVE-2026-100348\nCVE-2026-100349\nCVE-2026-100350\nCVE-2026-100351\nCVE-2026-100352\nCVE-2026-100353\nCVE-2026-100354\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"0888f3f1-d9b2-3166-9a1d-213d511f4a98","product":{"name":"hugo-0:0.168.0-0.1.hum1@s390x","vendor":{"name":"Red Hat"}}},{"id":"0d3926a5-07b1-3d2c-bac9-36ef90660fb4","product":{"name":"hugo-0:0.168.0-0.1.hum1@aarch64","vendor":{"name":"Red Hat"}}},{"id":"11faf46b-7717-359a-b011-0aaebeda5b13","product":{"name":"hugo-0:0.168.0-0.1.hum1@src","vendor":{"name":"Red Hat"}}},{"id":"d30ac518-ac4e-39bb-bb9d-1c155212f02f","product":{"name":"Red Hat Hardened Images","vendor":{"name":"Red Hat"}}},{"id":"f21cf517-05c4-3027-9787-c55b17e27cda","product":{"name":"hugo-0:0.168.0-0.1.hum1@x86_64","vendor":{"name":"Red Hat"}}}]}}]}