{"id":"EUVD-2026-102161","enisaUuid":"b6c620e5-73a4-3ce9-94db-1c54336fbece","description":"kin-openapi is a Go project for handling OpenAPI files. Prior to 0.148.0, the OpenAPI 3.1 validation path passes YAML NaN and infinity numeric values to santhosh-tekuri/jsonschema v6.0.2 without applying kin-openapi\u0027s existing finite-number guards. A remote unauthenticated client can send an application/yaml or application/x-yaml request body containing .nan, .inf, or -.inf to an operation with a numeric constraint, causing the dependency to create and dereference a nil big.Rat during ValidateRequest. Standard net/http servers recover the panic per connection, while other hosts or application goroutines may terminate the process. This issue is fixed in version 0.148.0.","datePublished":"Oct 15, 2026, 3:54:25 PM","dateUpdated":"Oct 20, 2026, 2:46:20 AM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/getkin/kin-openapi/security/advisories/GHSA-rj39-cv6w-8wv7\nhttps://github.com/getkin/kin-openapi/commit/4487f198ab8be0c37d6ca72c54f5dca4dc25270e\nhttps://github.com/getkin/kin-openapi/releases/tag/v0.148.0\n","aliases":"CVE-2026-100352\nGHSA-rj39-cv6w-8wv7\n","assigner":"GitHub_M","epss":0.6,"enisaIdProduct":[{"id":"52635a43-ad66-3a0f-91a5-0a66427a2696","product":{"name":"kin-openapi","vendor":{"name":"getkin"}},"product_version":"\u003c 0.148.0"}],"enisaIdVendor":[{"id":"ba93bafb-acba-3e42-85eb-ed8bc7ec8e4c","vendor":{"name":"getkin"}}],"enisaIdVulnerability":[{"id":"31e48784-d449-323c-8dcb-2beb87880a5d","vulnerability":{"id":"CVE-2026-100352","description":"kin-openapi is a Go project for handling OpenAPI files. Prior to 0.148.0, the OpenAPI 3.1 validation path passes YAML NaN and infinity numeric values to santhosh-tekuri/jsonschema v6.0.2 without applying kin-openapi\u0027s existing finite-number guards. A remote unauthenticated client can send an application/yaml or application/x-yaml request body containing .nan, .inf, or -.inf to an operation with a numeric constraint, causing the dependency to create and dereference a nil big.Rat during ValidateRequest. Standard net/http servers recover the panic per connection, while other hosts or application goroutines may terminate the process. This issue is fixed in version 0.148.0.","datePublished":"Oct 15, 2026, 3:54:25 PM","dateUpdated":"Oct 20, 2026, 2:46:20 AM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/getkin/kin-openapi/security/advisories/GHSA-rj39-cv6w-8wv7\nhttps://github.com/getkin/kin-openapi/commit/4487f198ab8be0c37d6ca72c54f5dca4dc25270e\nhttps://github.com/getkin/kin-openapi/releases/tag/v0.148.0\n","enisa_id":"EUVD-2026-102161\n","assigner":"GitHub_M","epss":0.6,"dataProcessed":"Nov 1, 2026, 1:46:23 AM","vulnerabilityProduct":[{"id":"30a99a43-76b1-338a-9857-09aef1209193","product":{"name":"kin-openapi","vendor":{"name":"getkin"}},"product_version":"\u003c 0.148.0"}],"vulnerabilityVendor":[{"id":"186b0e4f-ccb7-37cd-aa01-15536a00cd1e","vendor":{"name":"getkin"}}]}},{"id":"64382e65-abd1-334b-86a4-f06e79b264c1","vulnerability":{"id":"GHSA-rj39-cv6w-8wv7","description":"kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path","datePublished":"Oct 15, 2026, 8:20:27 PM","dateUpdated":"Oct 15, 2026, 8:20:27 PM","baseScore":0.0,"references":"https://github.com/getkin/kin-openapi/security/advisories/GHSA-rj39-cv6w-8wv7\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-100352\nhttps://github.com/getkin/kin-openapi/commit/4487f198ab8be0c37d6ca72c54f5dca4dc25270e\nhttps://github.com/getkin/kin-openapi\nhttps://github.com/getkin/kin-openapi/releases/tag/v0.148.0\n","enisa_id":"EUVD-2026-102161\n","aliases":"GHSA-rj39-cv6w-8wv7\nCVE-2026-100352\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:48 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"479e7318-a95d-3175-936c-b36d0a63e3bf","advisory":{"id":"openSUSE-SU-2026:12309-1","description":"timoni-0.36.0-1.1 on GA media","summary":"timoni-0.36.0-1.1 on GA media","datePublished":"Oct 27, 2026, 12:00:00 AM","dateUpdated":"Oct 28, 2026, 11:19:40 AM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_12309-1.json\nhttps://www.suse.com/security/cve/CVE-2024-45338/\nhttps://www.suse.com/security/cve/CVE-2025-22872/\nhttps://www.suse.com/security/cve/CVE-2025-47911/\nhttps://www.suse.com/security/cve/CVE-2025-58190/\nhttps://www.suse.com/security/cve/CVE-2026-100351/\nhttps://www.suse.com/security/cve/CVE-2026-100352/\nhttps://www.suse.com/security/cve/CVE-2026-100353/\nhttps://www.suse.com/security/cve/CVE-2026-100354/\nhttps://www.suse.com/security/cve/CVE-2026-33186/\nhttps://www.suse.com/security/cve/CVE-2026-78659/\nhttps://www.suse.com/security/cve/CVE-2026-78660/\nhttps://www.suse.com/security/cve/CVE-2026-78663/\nhttps://www.suse.com/security/cve/CVE-2026-78669/\nhttps://www.suse.com/security/cve/CVE-2026-97032/\n","aliases":"CVE-2024-45338\nCVE-2025-22872\nCVE-2025-47911\nCVE-2025-58190\nCVE-2026-100351\nCVE-2026-100352\nCVE-2026-100353\nCVE-2026-100354\nCVE-2026-33186\nCVE-2026-78659\nCVE-2026-78660\nCVE-2026-78663\nCVE-2026-78669\nCVE-2026-97032\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"08cba8f4-2fc9-3ece-86b7-6bbe45474f05","product":{"name":"timoni-zsh-completion-0:0.36.0-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"12fff569-0c80-30c6-ad8b-68668dc21d72","product":{"name":"timoni-0:0.36.0-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"1d9c53b8-46d0-399e-b23f-a19ab6d70902","product":{"name":"timoni-fish-completion-0:0.36.0-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"2515deac-1fb2-37c6-b6c3-0f1524c13f61","product":{"name":"timoni-0:0.36.0-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"3ee8baf9-ae1e-323e-8447-d0a63215f2f6","product":{"name":"timoni-bash-completion-0:0.36.0-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"4a68b659-8592-3087-b694-59694220ba21","product":{"name":"timoni-zsh-completion-0:0.36.0-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"4bdb7781-8ef7-3bee-8145-21e362c0485a","product":{"name":"timoni-bash-completion-0:0.36.0-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"6480055e-508f-3b11-9160-a72ee4a49dd5","product":{"name":"timoni-bash-completion-0:0.36.0-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"7debd1f5-44db-37fd-bb1e-6bbf1def4cde","product":{"name":"timoni-fish-completion-0:0.36.0-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"872ab211-c6ca-39f1-aadd-64d77f763c5c","product":{"name":"timoni-zsh-completion-0:0.36.0-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"9dcc78f4-343d-3d7b-a7fa-4f9d5ddfd92e","product":{"name":"openSUSE Tumbleweed","vendor":{"name":"SUSE"}}},{"id":"caf7b627-4747-3b31-8eb1-c50e9da7f59b","product":{"name":"timoni-zsh-completion-0:0.36.0-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"cbd3aecf-376d-3cd7-b543-64085149393f","product":{"name":"timoni-fish-completion-0:0.36.0-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"cf4702a8-a9a9-3ce8-8427-deb06ee15e8d","product":{"name":"timoni-0:0.36.0-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"ecc59d62-3f9d-3264-84c6-096e5e1f507b","product":{"name":"timoni-0:0.36.0-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"ee7ca2be-517f-3d37-9b19-d5ae1cb69461","product":{"name":"timoni-bash-completion-0:0.36.0-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"f638cbb1-75a4-3556-ab45-3ada712faaab","product":{"name":"timoni-fish-completion-0:0.36.0-1.1.s390x","vendor":{"name":"SUSE"}}}]}},{"id":"484a91d0-a7ff-3904-8295-5fad94bf677a","advisory":{"id":"RHSA-2026:82637","description":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","summary":"An update for Red Hat Hardened Images RPMs is now available.","datePublished":"Oct 14, 2026, 12:21:37 AM","dateUpdated":"Oct 30, 2026, 1:56:17 PM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:82637\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_82637.json\n","aliases":"CVE-2026-97394\nCVE-2026-100347\nCVE-2026-100348\nCVE-2026-100349\nCVE-2026-100350\nCVE-2026-100351\nCVE-2026-100352\nCVE-2026-100353\nCVE-2026-100354\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"0888f3f1-d9b2-3166-9a1d-213d511f4a98","product":{"name":"hugo-0:0.168.0-0.1.hum1@s390x","vendor":{"name":"Red Hat"}}},{"id":"0d3926a5-07b1-3d2c-bac9-36ef90660fb4","product":{"name":"hugo-0:0.168.0-0.1.hum1@aarch64","vendor":{"name":"Red Hat"}}},{"id":"11faf46b-7717-359a-b011-0aaebeda5b13","product":{"name":"hugo-0:0.168.0-0.1.hum1@src","vendor":{"name":"Red Hat"}}},{"id":"d30ac518-ac4e-39bb-bb9d-1c155212f02f","product":{"name":"Red Hat Hardened Images","vendor":{"name":"Red Hat"}}},{"id":"f21cf517-05c4-3027-9787-c55b17e27cda","product":{"name":"hugo-0:0.168.0-0.1.hum1@x86_64","vendor":{"name":"Red Hat"}}}]}},{"id":"66634a35-b376-3d4c-9646-7388a210dd87","advisory":{"id":"RHSA-2026:91292","description":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","summary":"An update for Red Hat Hardened Images RPMs is now available.","datePublished":"Oct 27, 2026, 8:42:51 PM","dateUpdated":"Oct 30, 2026, 1:56:31 PM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:91292\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_91292.json\n","aliases":"CVE-2026-79656\nCVE-2026-100352\nCVE-2026-100353\nCVE-2026-100354\nCVE-2026-103506\nCVE-2026-110095\nCVE-2026-110180\nCVE-2026-110306\nCVE-2026-110725\nCVE-2026-111181\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"7ea263c9-7ae7-3637-b305-7e5b8e22dbe3","product":{"name":"grafana12.4-0:12.4.13-0.5.hum1@aarch64","vendor":{"name":"Red Hat"}}},{"id":"8873e195-a9a1-347c-8990-adc821a28f6a","product":{"name":"grafana12.4-0:12.4.13-0.5.hum1@x86_64","vendor":{"name":"Red Hat"}}},{"id":"d931ebbc-1bf9-3579-9991-9db75c1eb47c","product":{"name":"Red Hat Hardened Images","vendor":{"name":"Red Hat"}}},{"id":"ee7c2ecc-85ca-3490-9c3d-ef012bf57f06","product":{"name":"grafana12.4-0:12.4.13-0.5.hum1@src","vendor":{"name":"Red Hat"}}}]}},{"id":"916623e7-1615-3925-9d2e-9517d6843551","advisory":{"id":"RHSA-2026:87077","description":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","summary":"An update for Red Hat Hardened Images RPMs is now available.","datePublished":"Oct 21, 2026, 2:59:57 PM","dateUpdated":"Oct 31, 2026, 3:44:49 PM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:87077\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_87077.json\n","aliases":"CVE-2026-15577\nCVE-2026-33374\nCVE-2026-92539\nCVE-2026-93294\nCVE-2026-95502\nCVE-2026-100347\nCVE-2026-100348\nCVE-2026-100349\nCVE-2026-100351\nCVE-2026-100352\nCVE-2026-100353\nCVE-2026-100354\nCVE-2026-110816\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"5f1a0d9b-0fe1-3332-8c5f-7d2a272304e8","product":{"name":"Red Hat Hardened Images","vendor":{"name":"Red Hat"}}},{"id":"9ffad9db-9975-302f-bc87-180a0e507f2b","product":{"name":"grafana13.1-0:13.1.8-0.3.hum1@x86_64","vendor":{"name":"Red Hat"}}},{"id":"b3b55662-76eb-3a93-a447-3c0362fb32e6","product":{"name":"grafana13.1-0:13.1.8-0.3.hum1@src","vendor":{"name":"Red Hat"}}},{"id":"d9d9f30e-7c1f-3413-9095-a5f4054ec4a5","product":{"name":"grafana13.1-0:13.1.8-0.3.hum1@s390x","vendor":{"name":"Red Hat"}}},{"id":"da94b432-0233-3aa5-b005-60d231916edd","product":{"name":"grafana13.1-0:13.1.8-0.3.hum1@aarch64","vendor":{"name":"Red Hat"}}}]}},{"id":"9cf9053f-6e97-39d6-9ea2-9eca0a9e04dd","advisory":{"id":"RHSA-2026:85266","description":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","summary":"An update for Red Hat Hardened Images RPMs is now available.","datePublished":"Oct 19, 2026, 7:02:40 PM","dateUpdated":"Oct 29, 2026, 8:40:40 PM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:85266\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_85266.json\n","aliases":"CVE-2026-93450\nCVE-2026-100347\nCVE-2026-100348\nCVE-2026-100349\nCVE-2026-100351\nCVE-2026-100352\nCVE-2026-100353\nCVE-2026-100354\nCVE-2026-110816\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"39b28d33-c263-352c-909d-e66dfcea4619","product":{"name":"grafana13.2-0:13.2.3-0.3.hum1@aarch64","vendor":{"name":"Red Hat"}}},{"id":"60cc3524-7d6c-38c6-8cae-179b42ce169e","product":{"name":"grafana13.2-0:13.2.3-0.3.hum1@src","vendor":{"name":"Red Hat"}}},{"id":"bd3c067e-3a7e-3b44-bbcb-80a512e34e4d","product":{"name":"grafana13.2-0:13.2.3-0.3.hum1@x86_64","vendor":{"name":"Red Hat"}}},{"id":"c7342884-4506-3372-a476-1e94b785015b","product":{"name":"grafana13.2-0:13.2.3-0.3.hum1@s390x","vendor":{"name":"Red Hat"}}},{"id":"de0a7631-81a4-3778-ba4f-8437f287389b","product":{"name":"Red Hat Hardened Images","vendor":{"name":"Red Hat"}}}]}},{"id":"9de21869-47c4-35fb-86bc-54386b7c95fa","advisory":{"id":"openSUSE-SU-2026:12164-1","description":"hugo-0.168.0-2.1 on GA media","summary":"hugo-0.168.0-2.1 on GA media","datePublished":"Oct 17, 2026, 12:00:00 AM","dateUpdated":"Oct 18, 2026, 10:27:41 AM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_12164-1.json\nhttps://www.suse.com/security/cve/CVE-2026-100347/\nhttps://www.suse.com/security/cve/CVE-2026-100348/\nhttps://www.suse.com/security/cve/CVE-2026-100349/\nhttps://www.suse.com/security/cve/CVE-2026-100350/\nhttps://www.suse.com/security/cve/CVE-2026-100351/\nhttps://www.suse.com/security/cve/CVE-2026-100352/\n","aliases":"CVE-2026-100347\nCVE-2026-100348\nCVE-2026-100349\nCVE-2026-100350\nCVE-2026-100351\nCVE-2026-100352\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"0e391701-ba76-3fef-b408-044aed9ab21e","product":{"name":"hugo-zsh-completion-0:0.168.0-2.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"15961777-7bf4-3dab-8d62-6722e72f64b4","product":{"name":"hugo-bash-completion-0:0.168.0-2.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"1725178b-76ef-3065-ae60-74ef0db9e100","product":{"name":"hugo-zsh-completion-0:0.168.0-2.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"1a0d67d9-3027-3f35-89ee-8260acb32af4","product":{"name":"openSUSE Tumbleweed","vendor":{"name":"SUSE"}}},{"id":"36673632-aed2-3a9d-84b1-658579db3fb1","product":{"name":"hugo-bash-completion-0:0.168.0-2.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"46b34a85-1ffd-36f6-b889-e0c7d78fdc74","product":{"name":"hugo-zsh-completion-0:0.168.0-2.1.s390x","vendor":{"name":"SUSE"}}},{"id":"53a89638-469e-38ea-bf8f-cbe1cec5b8fc","product":{"name":"hugo-bash-completion-0:0.168.0-2.1.s390x","vendor":{"name":"SUSE"}}},{"id":"54dfb111-c7ad-32bb-aaf7-3e0cb05d5d34","product":{"name":"hugo-0:0.168.0-2.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"64c3513c-b761-3b6e-93a5-5cbb6da5cf45","product":{"name":"hugo-0:0.168.0-2.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"7ea5f117-ac48-3f02-bc1b-6b7c6fa770b4","product":{"name":"hugo-0:0.168.0-2.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"a2e89ddf-8df9-35d1-9b39-1155a65fc833","product":{"name":"hugo-0:0.168.0-2.1.s390x","vendor":{"name":"SUSE"}}},{"id":"cca5d804-5d66-353a-92db-0d0068da432d","product":{"name":"hugo-zsh-completion-0:0.168.0-2.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"db311cf5-f48b-32f8-9d4b-0d271f4683c2","product":{"name":"hugo-bash-completion-0:0.168.0-2.1.ppc64le","vendor":{"name":"SUSE"}}}]}},{"id":"c24c8144-5051-30d5-aa1d-63ed8666e0c9","advisory":{"id":"RHSA-2026:90388","description":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","summary":"An update for Red Hat Hardened Images RPMs is now available.","datePublished":"Oct 26, 2026, 5:44:40 PM","dateUpdated":"Oct 30, 2026, 1:56:27 PM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:90388\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_90388.json\n","aliases":"CVE-2026-65627\nCVE-2026-100352\nCVE-2026-100353\nCVE-2026-100354\nCVE-2026-110095\nCVE-2026-110180\nCVE-2026-110306\nCVE-2026-110725\nCVE-2026-110816\nCVE-2026-111181\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"6d5c24e2-68ed-32ce-bae9-507625ce7a00","product":{"name":"Red Hat Hardened Images","vendor":{"name":"Red Hat"}}},{"id":"78d49ec6-bf11-31ef-a541-1e93191b3e6f","product":{"name":"grafana12.4-0:12.4.13-0.4.hum1@aarch64","vendor":{"name":"Red Hat"}}},{"id":"7c2052b5-052d-3d7a-b6c9-f41b5f495208","product":{"name":"grafana12.4-0:12.4.13-0.4.hum1@src","vendor":{"name":"Red Hat"}}},{"id":"83374cd3-7f48-3f46-86cf-9be5bbc1ae00","product":{"name":"grafana12.4-0:12.4.13-0.4.hum1@x86_64","vendor":{"name":"Red Hat"}}}]}}]}