{"id":"EUVD-2026-102161","revision":"3e7190b3b32b4709ab3def90988e9b28","records":[{"revision":"3e7190b3b32b4709ab3def90988e9b28","observedAt":"2026-11-07T03:36:44.231+00:00","statement":{"source":"euvd","id":"EUVD-2026-102161","aliases":["CVE-2026-100352","GHSA-rj39-cv6w-8wv7"],"title":"kin-openapi is a Go project for handling OpenAPI files. Prior to 0.148.0, the OpenAPI 3.1 validation path passes YAML NaN and infinity numeric values to santhosh-tekuri/jsonschema v6.0.2 without applying kin-openapi's existing finite-number…","description":"kin-openapi is a Go project for handling OpenAPI files. Prior to 0.148.0, the OpenAPI 3.1 validation path passes YAML NaN and infinity numeric values to santhosh-tekuri/jsonschema v6.0.2 without applying kin-openapi's existing finite-number guards. A remote unauthenticated client can send an application/yaml or application/x-yaml request body containing .nan, .inf, or -.inf to an operation with a numeric constraint, causing the dependency to create and dereference a nil big.Rat during ValidateRequest. Standard net/http servers recover the panic per connection, while other hosts or application goroutines may terminate the process. This issue is fixed in version 0.148.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":null}],"references":["https://github.com/getkin/kin-openapi/security/advisories/GHSA-rj39-cv6w-8wv7","https://github.com/getkin/kin-openapi/commit/4487f198ab8be0c37d6ca72c54f5dca4dc25270e","https://github.com/getkin/kin-openapi/releases/tag/v0.148.0"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-102161","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Oct 15, 2026, 3:54:25 PM","dateUpdated":"Oct 20, 2026, 2:46:20 AM"},"relatedAdvisories":[{"id":"openSUSE-SU-2026:12309-1","title":"timoni-0.36.0-1.1 on GA media","vulnerabilityIds":["CVE-2024-45338","CVE-2025-22872","CVE-2025-47911","CVE-2025-58190","CVE-2026-100351","CVE-2026-100352","CVE-2026-100353","CVE-2026-100354","CVE-2026-33186","CVE-2026-78659","CVE-2026-78660","CVE-2026-78663","CVE-2026-78669","CVE-2026-97032"]},{"id":"RHSA-2026:82637","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","vulnerabilityIds":["CVE-2026-97394","CVE-2026-100347","CVE-2026-100348","CVE-2026-100349","CVE-2026-100350","CVE-2026-100351","CVE-2026-100352","CVE-2026-100353","CVE-2026-100354"]},{"id":"RHSA-2026:91292","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2026-79656","CVE-2026-100352","CVE-2026-100353","CVE-2026-100354","CVE-2026-103506","CVE-2026-110095","CVE-2026-110180","CVE-2026-110306","CVE-2026-110725","CVE-2026-111181"]},{"id":"RHSA-2026:87077","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2026-15577","CVE-2026-33374","CVE-2026-92539","CVE-2026-93294","CVE-2026-95502","CVE-2026-100347","CVE-2026-100348","CVE-2026-100349","CVE-2026-100351","CVE-2026-100352","CVE-2026-100353","CVE-2026-100354","CVE-2026-110816"]},{"id":"RHSA-2026:85266","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2026-93450","CVE-2026-100347","CVE-2026-100348","CVE-2026-100349","CVE-2026-100351","CVE-2026-100352","CVE-2026-100353","CVE-2026-100354","CVE-2026-110816"]},{"id":"openSUSE-SU-2026:12164-1","title":"hugo-0.168.0-2.1 on GA media","vulnerabilityIds":["CVE-2026-100347","CVE-2026-100348","CVE-2026-100349","CVE-2026-100350","CVE-2026-100351","CVE-2026-100352"]},{"id":"RHSA-2026:90388","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2026-65627","CVE-2026-100352","CVE-2026-100353","CVE-2026-100354","CVE-2026-110095","CVE-2026-110180","CVE-2026-110306","CVE-2026-110725","CVE-2026-110816","CVE-2026-111181"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-102161","identifiers":["EUVD-2026-102161","CVE-2026-100352","GHSA-rj39-cv6w-8wv7"]},"retained":false,"historicalAffected":[]}],"coverage":[]}