{"id":"EUVD-2026-102163","enisaUuid":"50a378ad-48ba-33b6-bbf4-df8307573bb1","description":"kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.149.0, three openapi3filter decoder paths that were missed by the fix for GHSA-p6wj-qrr4-pgh5 lack a nil-items guard for legal OpenAPI 3.1 array schemas. An unauthenticated remote client can trigger a deterministic nil-pointer panic through an array query parameter, a deepObject query parameter containing an array property, or an application/x-www-form-urlencoded request body whose array property appears inside an allOf, anyOf, or oneOf subschema. The query and composed-body paths reach urlValuesDecoder.parseArray, while the deepObject path reaches buildResObj, and all pass a nil items schema into code that dereferences it. This issue is fixed in version 0.149.0.","datePublished":"Oct 15, 2026, 4:03:50 PM","dateUpdated":"Oct 29, 2026, 1:41:31 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/getkin/kin-openapi/security/advisories/GHSA-vrcc-3ch7-hppw\nhttps://github.com/getkin/kin-openapi/commit/9814d1f2b212f3508bf52296aa9e248b2122a5a9\nhttps://github.com/getkin/kin-openapi/releases/tag/v0.149.0\n","aliases":"CVE-2026-100353\nGHSA-vrcc-3ch7-hppw\n","assigner":"GitHub_M","epss":0.33,"enisaIdProduct":[{"id":"c8e403c9-f562-3dd9-bab4-dcb83de034b9","product":{"name":"kin-openapi","vendor":{"name":"getkin"}},"product_version":"0.136.0, \u003c 0.149.0"}],"enisaIdVendor":[{"id":"98d8837e-9257-345a-8570-356c95a4d865","vendor":{"name":"getkin"}}],"enisaIdVulnerability":[{"id":"2e973917-b6be-3479-9c19-3d61479c2faf","vulnerability":{"id":"CVE-2026-100353","description":"kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.149.0, three openapi3filter decoder paths that were missed by the fix for GHSA-p6wj-qrr4-pgh5 lack a nil-items guard for legal OpenAPI 3.1 array schemas. An unauthenticated remote client can trigger a deterministic nil-pointer panic through an array query parameter, a deepObject query parameter containing an array property, or an application/x-www-form-urlencoded request body whose array property appears inside an allOf, anyOf, or oneOf subschema. The query and composed-body paths reach urlValuesDecoder.parseArray, while the deepObject path reaches buildResObj, and all pass a nil items schema into code that dereferences it. This issue is fixed in version 0.149.0.","datePublished":"Oct 15, 2026, 4:03:50 PM","dateUpdated":"Oct 29, 2026, 1:41:31 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/getkin/kin-openapi/security/advisories/GHSA-vrcc-3ch7-hppw\nhttps://github.com/getkin/kin-openapi/commit/9814d1f2b212f3508bf52296aa9e248b2122a5a9\nhttps://github.com/getkin/kin-openapi/releases/tag/v0.149.0\n","enisa_id":"EUVD-2026-102163\n","assigner":"GitHub_M","epss":0.33,"dataProcessed":"Nov 1, 2026, 1:46:23 AM","vulnerabilityProduct":[{"id":"20b1c509-8e22-310a-b7d6-864551e13486","product":{"name":"kin-openapi","vendor":{"name":"getkin"}},"product_version":"0.136.0, \u003c 0.149.0"}],"vulnerabilityVendor":[{"id":"e4492c0c-ba5b-385c-bc9e-a275f0dca314","vendor":{"name":"getkin"}}]}},{"id":"75d734d4-f93d-3747-8328-1a720d2acaf9","vulnerability":{"id":"GHSA-vrcc-3ch7-hppw","description":"kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter","datePublished":"Oct 15, 2026, 8:20:47 PM","dateUpdated":"Oct 15, 2026, 8:20:47 PM","baseScore":0.0,"references":"https://github.com/getkin/kin-openapi/security/advisories/GHSA-vrcc-3ch7-hppw\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-100353\nhttps://github.com/getkin/kin-openapi/commit/9814d1f2b212f3508bf52296aa9e248b2122a5a9\nhttps://github.com/getkin/kin-openapi\nhttps://github.com/getkin/kin-openapi/releases/tag/v0.149.0\n","enisa_id":"EUVD-2026-102163\n","aliases":"GHSA-vrcc-3ch7-hppw\nCVE-2026-100353\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:48 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"279ae762-5867-3265-b186-0b0879518169","advisory":{"id":"RHSA-2026:87077","description":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","summary":"An update for Red Hat Hardened Images RPMs is now available.","datePublished":"Oct 21, 2026, 2:59:57 PM","dateUpdated":"Oct 31, 2026, 3:44:49 PM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:87077\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_87077.json\n","aliases":"CVE-2026-15577\nCVE-2026-33374\nCVE-2026-92539\nCVE-2026-93294\nCVE-2026-95502\nCVE-2026-100347\nCVE-2026-100348\nCVE-2026-100349\nCVE-2026-100351\nCVE-2026-100352\nCVE-2026-100353\nCVE-2026-100354\nCVE-2026-110816\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"5f1a0d9b-0fe1-3332-8c5f-7d2a272304e8","product":{"name":"Red Hat Hardened Images","vendor":{"name":"Red Hat"}}},{"id":"9ffad9db-9975-302f-bc87-180a0e507f2b","product":{"name":"grafana13.1-0:13.1.8-0.3.hum1@x86_64","vendor":{"name":"Red Hat"}}},{"id":"b3b55662-76eb-3a93-a447-3c0362fb32e6","product":{"name":"grafana13.1-0:13.1.8-0.3.hum1@src","vendor":{"name":"Red Hat"}}},{"id":"d9d9f30e-7c1f-3413-9095-a5f4054ec4a5","product":{"name":"grafana13.1-0:13.1.8-0.3.hum1@s390x","vendor":{"name":"Red Hat"}}},{"id":"da94b432-0233-3aa5-b005-60d231916edd","product":{"name":"grafana13.1-0:13.1.8-0.3.hum1@aarch64","vendor":{"name":"Red Hat"}}}]}},{"id":"6774c428-3566-3d03-9a27-988cfeb2a881","advisory":{"id":"RHSA-2026:91292","description":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","summary":"An update for Red Hat Hardened Images RPMs is now available.","datePublished":"Oct 27, 2026, 8:42:51 PM","dateUpdated":"Oct 30, 2026, 1:56:31 PM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:91292\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_91292.json\n","aliases":"CVE-2026-79656\nCVE-2026-100352\nCVE-2026-100353\nCVE-2026-100354\nCVE-2026-103506\nCVE-2026-110095\nCVE-2026-110180\nCVE-2026-110306\nCVE-2026-110725\nCVE-2026-111181\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"7ea263c9-7ae7-3637-b305-7e5b8e22dbe3","product":{"name":"grafana12.4-0:12.4.13-0.5.hum1@aarch64","vendor":{"name":"Red Hat"}}},{"id":"8873e195-a9a1-347c-8990-adc821a28f6a","product":{"name":"grafana12.4-0:12.4.13-0.5.hum1@x86_64","vendor":{"name":"Red Hat"}}},{"id":"d931ebbc-1bf9-3579-9991-9db75c1eb47c","product":{"name":"Red Hat Hardened Images","vendor":{"name":"Red Hat"}}},{"id":"ee7c2ecc-85ca-3490-9c3d-ef012bf57f06","product":{"name":"grafana12.4-0:12.4.13-0.5.hum1@src","vendor":{"name":"Red Hat"}}}]}},{"id":"996bc357-8939-3c47-b51b-94b62cfbea2e","advisory":{"id":"RHSA-2026:85266","description":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","summary":"An update for Red Hat Hardened Images RPMs is now available.","datePublished":"Oct 19, 2026, 7:02:40 PM","dateUpdated":"Oct 29, 2026, 8:40:40 PM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:85266\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_85266.json\n","aliases":"CVE-2026-93450\nCVE-2026-100347\nCVE-2026-100348\nCVE-2026-100349\nCVE-2026-100351\nCVE-2026-100352\nCVE-2026-100353\nCVE-2026-100354\nCVE-2026-110816\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"39b28d33-c263-352c-909d-e66dfcea4619","product":{"name":"grafana13.2-0:13.2.3-0.3.hum1@aarch64","vendor":{"name":"Red Hat"}}},{"id":"60cc3524-7d6c-38c6-8cae-179b42ce169e","product":{"name":"grafana13.2-0:13.2.3-0.3.hum1@src","vendor":{"name":"Red Hat"}}},{"id":"bd3c067e-3a7e-3b44-bbcb-80a512e34e4d","product":{"name":"grafana13.2-0:13.2.3-0.3.hum1@x86_64","vendor":{"name":"Red Hat"}}},{"id":"c7342884-4506-3372-a476-1e94b785015b","product":{"name":"grafana13.2-0:13.2.3-0.3.hum1@s390x","vendor":{"name":"Red Hat"}}},{"id":"de0a7631-81a4-3778-ba4f-8437f287389b","product":{"name":"Red Hat Hardened Images","vendor":{"name":"Red Hat"}}}]}},{"id":"a544ffad-4070-3720-b8ab-6e6808fb37f5","advisory":{"id":"RHSA-2026:82637","description":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","summary":"An update for Red Hat Hardened Images RPMs is now available.","datePublished":"Oct 14, 2026, 12:21:37 AM","dateUpdated":"Oct 30, 2026, 1:56:17 PM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:82637\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_82637.json\n","aliases":"CVE-2026-97394\nCVE-2026-100347\nCVE-2026-100348\nCVE-2026-100349\nCVE-2026-100350\nCVE-2026-100351\nCVE-2026-100352\nCVE-2026-100353\nCVE-2026-100354\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"0888f3f1-d9b2-3166-9a1d-213d511f4a98","product":{"name":"hugo-0:0.168.0-0.1.hum1@s390x","vendor":{"name":"Red Hat"}}},{"id":"0d3926a5-07b1-3d2c-bac9-36ef90660fb4","product":{"name":"hugo-0:0.168.0-0.1.hum1@aarch64","vendor":{"name":"Red Hat"}}},{"id":"11faf46b-7717-359a-b011-0aaebeda5b13","product":{"name":"hugo-0:0.168.0-0.1.hum1@src","vendor":{"name":"Red Hat"}}},{"id":"d30ac518-ac4e-39bb-bb9d-1c155212f02f","product":{"name":"Red Hat Hardened Images","vendor":{"name":"Red Hat"}}},{"id":"f21cf517-05c4-3027-9787-c55b17e27cda","product":{"name":"hugo-0:0.168.0-0.1.hum1@x86_64","vendor":{"name":"Red Hat"}}}]}},{"id":"a9b91945-44e8-3af2-bb68-686709aaf452","advisory":{"id":"openSUSE-SU-2026:12309-1","description":"timoni-0.36.0-1.1 on GA media","summary":"timoni-0.36.0-1.1 on GA media","datePublished":"Oct 27, 2026, 12:00:00 AM","dateUpdated":"Oct 28, 2026, 11:19:40 AM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_12309-1.json\nhttps://www.suse.com/security/cve/CVE-2024-45338/\nhttps://www.suse.com/security/cve/CVE-2025-22872/\nhttps://www.suse.com/security/cve/CVE-2025-47911/\nhttps://www.suse.com/security/cve/CVE-2025-58190/\nhttps://www.suse.com/security/cve/CVE-2026-100351/\nhttps://www.suse.com/security/cve/CVE-2026-100352/\nhttps://www.suse.com/security/cve/CVE-2026-100353/\nhttps://www.suse.com/security/cve/CVE-2026-100354/\nhttps://www.suse.com/security/cve/CVE-2026-33186/\nhttps://www.suse.com/security/cve/CVE-2026-78659/\nhttps://www.suse.com/security/cve/CVE-2026-78660/\nhttps://www.suse.com/security/cve/CVE-2026-78663/\nhttps://www.suse.com/security/cve/CVE-2026-78669/\nhttps://www.suse.com/security/cve/CVE-2026-97032/\n","aliases":"CVE-2024-45338\nCVE-2025-22872\nCVE-2025-47911\nCVE-2025-58190\nCVE-2026-100351\nCVE-2026-100352\nCVE-2026-100353\nCVE-2026-100354\nCVE-2026-33186\nCVE-2026-78659\nCVE-2026-78660\nCVE-2026-78663\nCVE-2026-78669\nCVE-2026-97032\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"08cba8f4-2fc9-3ece-86b7-6bbe45474f05","product":{"name":"timoni-zsh-completion-0:0.36.0-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"12fff569-0c80-30c6-ad8b-68668dc21d72","product":{"name":"timoni-0:0.36.0-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"1d9c53b8-46d0-399e-b23f-a19ab6d70902","product":{"name":"timoni-fish-completion-0:0.36.0-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"2515deac-1fb2-37c6-b6c3-0f1524c13f61","product":{"name":"timoni-0:0.36.0-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"3ee8baf9-ae1e-323e-8447-d0a63215f2f6","product":{"name":"timoni-bash-completion-0:0.36.0-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"4a68b659-8592-3087-b694-59694220ba21","product":{"name":"timoni-zsh-completion-0:0.36.0-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"4bdb7781-8ef7-3bee-8145-21e362c0485a","product":{"name":"timoni-bash-completion-0:0.36.0-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"6480055e-508f-3b11-9160-a72ee4a49dd5","product":{"name":"timoni-bash-completion-0:0.36.0-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"7debd1f5-44db-37fd-bb1e-6bbf1def4cde","product":{"name":"timoni-fish-completion-0:0.36.0-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"872ab211-c6ca-39f1-aadd-64d77f763c5c","product":{"name":"timoni-zsh-completion-0:0.36.0-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"9dcc78f4-343d-3d7b-a7fa-4f9d5ddfd92e","product":{"name":"openSUSE Tumbleweed","vendor":{"name":"SUSE"}}},{"id":"caf7b627-4747-3b31-8eb1-c50e9da7f59b","product":{"name":"timoni-zsh-completion-0:0.36.0-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"cbd3aecf-376d-3cd7-b543-64085149393f","product":{"name":"timoni-fish-completion-0:0.36.0-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"cf4702a8-a9a9-3ce8-8427-deb06ee15e8d","product":{"name":"timoni-0:0.36.0-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"ecc59d62-3f9d-3264-84c6-096e5e1f507b","product":{"name":"timoni-0:0.36.0-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"ee7ca2be-517f-3d37-9b19-d5ae1cb69461","product":{"name":"timoni-bash-completion-0:0.36.0-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"f638cbb1-75a4-3556-ab45-3ada712faaab","product":{"name":"timoni-fish-completion-0:0.36.0-1.1.s390x","vendor":{"name":"SUSE"}}}]}},{"id":"f8870fdc-4f8e-330f-bae6-040104bc3b8b","advisory":{"id":"RHSA-2026:90388","description":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","summary":"An update for Red Hat Hardened Images RPMs is now available.","datePublished":"Oct 26, 2026, 5:44:40 PM","dateUpdated":"Oct 30, 2026, 1:56:27 PM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:90388\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_90388.json\n","aliases":"CVE-2026-65627\nCVE-2026-100352\nCVE-2026-100353\nCVE-2026-100354\nCVE-2026-110095\nCVE-2026-110180\nCVE-2026-110306\nCVE-2026-110725\nCVE-2026-110816\nCVE-2026-111181\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"6d5c24e2-68ed-32ce-bae9-507625ce7a00","product":{"name":"Red Hat Hardened Images","vendor":{"name":"Red Hat"}}},{"id":"78d49ec6-bf11-31ef-a541-1e93191b3e6f","product":{"name":"grafana12.4-0:12.4.13-0.4.hum1@aarch64","vendor":{"name":"Red Hat"}}},{"id":"7c2052b5-052d-3d7a-b6c9-f41b5f495208","product":{"name":"grafana12.4-0:12.4.13-0.4.hum1@src","vendor":{"name":"Red Hat"}}},{"id":"83374cd3-7f48-3f46-86cf-9be5bbc1ae00","product":{"name":"grafana12.4-0:12.4.13-0.4.hum1@x86_64","vendor":{"name":"Red Hat"}}}]}}]}