{"id":"EUVD-2026-102163","enisaUuid":"50a378ad-48ba-33b6-bbf4-df8307573bb1","description":"kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.149.0, three openapi3filter decoder paths that were missed by the fix for GHSA-p6wj-qrr4-pgh5 lack a nil-items guard for legal OpenAPI 3.1 array schemas. An unauthenticated remote client can trigger a deterministic nil-pointer panic through an array query parameter, a deepObject query parameter containing an array property, or an application/x-www-form-urlencoded request body whose array property appears inside an allOf, anyOf, or oneOf subschema. The query and composed-body paths reach urlValuesDecoder.parseArray, while the deepObject path reaches buildResObj, and all pass a nil items schema into code that dereferences it. This issue is fixed in version 0.149.0.","datePublished":"Oct 15, 2026, 4:03:50 PM","dateUpdated":"Oct 15, 2026, 4:03:50 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/getkin/kin-openapi/security/advisories/GHSA-vrcc-3ch7-hppw\nhttps://github.com/getkin/kin-openapi/commit/9814d1f2b212f3508bf52296aa9e248b2122a5a9\nhttps://github.com/getkin/kin-openapi/releases/tag/v0.149.0\n","aliases":"CVE-2026-100353\nGHSA-vrcc-3ch7-hppw\n","assigner":"GitHub_M","epss":0.33,"enisaIdProduct":[{"id":"c8e403c9-f562-3dd9-bab4-dcb83de034b9","product":{"name":"kin-openapi","vendor":{"name":"getkin"}},"product_version":"0.136.0, \u003c 0.149.0"}],"enisaIdVendor":[{"id":"98d8837e-9257-345a-8570-356c95a4d865","vendor":{"name":"getkin"}}],"enisaIdVulnerability":[{"id":"2e973917-b6be-3479-9c19-3d61479c2faf","vulnerability":{"id":"CVE-2026-100353","description":"kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.149.0, three openapi3filter decoder paths that were missed by the fix for GHSA-p6wj-qrr4-pgh5 lack a nil-items guard for legal OpenAPI 3.1 array schemas. An unauthenticated remote client can trigger a deterministic nil-pointer panic through an array query parameter, a deepObject query parameter containing an array property, or an application/x-www-form-urlencoded request body whose array property appears inside an allOf, anyOf, or oneOf subschema. The query and composed-body paths reach urlValuesDecoder.parseArray, while the deepObject path reaches buildResObj, and all pass a nil items schema into code that dereferences it. This issue is fixed in version 0.149.0.","datePublished":"Oct 15, 2026, 4:03:50 PM","dateUpdated":"Oct 15, 2026, 4:03:50 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/getkin/kin-openapi/security/advisories/GHSA-vrcc-3ch7-hppw\nhttps://github.com/getkin/kin-openapi/commit/9814d1f2b212f3508bf52296aa9e248b2122a5a9\nhttps://github.com/getkin/kin-openapi/releases/tag/v0.149.0\n","enisa_id":"EUVD-2026-102163\n","assigner":"GitHub_M","epss":0.33,"dataProcessed":"Oct 27, 2026, 7:15:34 AM","vulnerabilityProduct":[{"id":"20b1c509-8e22-310a-b7d6-864551e13486","product":{"name":"kin-openapi","vendor":{"name":"getkin"}},"product_version":"0.136.0, \u003c 0.149.0"}],"vulnerabilityVendor":[{"id":"e4492c0c-ba5b-385c-bc9e-a275f0dca314","vendor":{"name":"getkin"}}]}},{"id":"75d734d4-f93d-3747-8328-1a720d2acaf9","vulnerability":{"id":"GHSA-vrcc-3ch7-hppw","description":"kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter","datePublished":"Oct 15, 2026, 8:20:47 PM","dateUpdated":"Oct 15, 2026, 8:20:47 PM","baseScore":0.0,"references":"https://github.com/getkin/kin-openapi/security/advisories/GHSA-vrcc-3ch7-hppw\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-100353\nhttps://github.com/getkin/kin-openapi/commit/9814d1f2b212f3508bf52296aa9e248b2122a5a9\nhttps://github.com/getkin/kin-openapi\nhttps://github.com/getkin/kin-openapi/releases/tag/v0.149.0\n","enisa_id":"EUVD-2026-102163\n","aliases":"GHSA-vrcc-3ch7-hppw\nCVE-2026-100353\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:03:05 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"279ae762-5867-3265-b186-0b0879518169","advisory":{"id":"RHSA-2026:87077","description":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","summary":"An update for Red Hat Hardened Images RPMs is now available.","datePublished":"Oct 21, 2026, 2:59:57 PM","dateUpdated":"Oct 21, 2026, 7:42:09 PM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:87077\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_87077.json\n","aliases":"CVE-2026-15577\nCVE-2026-33374\nCVE-2026-92539\nCVE-2026-93294\nCVE-2026-95502\nCVE-2026-100347\nCVE-2026-100348\nCVE-2026-100349\nCVE-2026-100351\nCVE-2026-100352\nCVE-2026-100353\nCVE-2026-100354\nCVE-2026-110816\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"5f1a0d9b-0fe1-3332-8c5f-7d2a272304e8","product":{"name":"Red Hat Hardened Images","vendor":{"name":"Red Hat"}}},{"id":"9ffad9db-9975-302f-bc87-180a0e507f2b","product":{"name":"grafana13.1-0:13.1.8-0.3.hum1@x86_64","vendor":{"name":"Red Hat"}}},{"id":"b3b55662-76eb-3a93-a447-3c0362fb32e6","product":{"name":"grafana13.1-0:13.1.8-0.3.hum1@src","vendor":{"name":"Red Hat"}}},{"id":"d9d9f30e-7c1f-3413-9095-a5f4054ec4a5","product":{"name":"grafana13.1-0:13.1.8-0.3.hum1@s390x","vendor":{"name":"Red Hat"}}},{"id":"da94b432-0233-3aa5-b005-60d231916edd","product":{"name":"grafana13.1-0:13.1.8-0.3.hum1@aarch64","vendor":{"name":"Red Hat"}}}]}},{"id":"996bc357-8939-3c47-b51b-94b62cfbea2e","advisory":{"id":"RHSA-2026:85266","description":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","summary":"An update for Red Hat Hardened Images RPMs is now available.","datePublished":"Oct 19, 2026, 7:02:40 PM","dateUpdated":"Oct 21, 2026, 7:42:24 PM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:85266\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_85266.json\n","aliases":"CVE-2026-93450\nCVE-2026-100347\nCVE-2026-100348\nCVE-2026-100349\nCVE-2026-100351\nCVE-2026-100352\nCVE-2026-100353\nCVE-2026-100354\nCVE-2026-110816\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"39b28d33-c263-352c-909d-e66dfcea4619","product":{"name":"grafana13.2-0:13.2.3-0.3.hum1@aarch64","vendor":{"name":"Red Hat"}}},{"id":"60cc3524-7d6c-38c6-8cae-179b42ce169e","product":{"name":"grafana13.2-0:13.2.3-0.3.hum1@src","vendor":{"name":"Red Hat"}}},{"id":"bd3c067e-3a7e-3b44-bbcb-80a512e34e4d","product":{"name":"grafana13.2-0:13.2.3-0.3.hum1@x86_64","vendor":{"name":"Red Hat"}}},{"id":"c7342884-4506-3372-a476-1e94b785015b","product":{"name":"grafana13.2-0:13.2.3-0.3.hum1@s390x","vendor":{"name":"Red Hat"}}},{"id":"de0a7631-81a4-3778-ba4f-8437f287389b","product":{"name":"Red Hat Hardened Images","vendor":{"name":"Red Hat"}}}]}},{"id":"a544ffad-4070-3720-b8ab-6e6808fb37f5","advisory":{"id":"RHSA-2026:82637","description":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","summary":"An update for Red Hat Hardened Images RPMs is now available.","datePublished":"Oct 14, 2026, 12:21:37 AM","dateUpdated":"Oct 21, 2026, 7:42:22 PM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:82637\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_82637.json\n","aliases":"CVE-2026-97394\nCVE-2026-100347\nCVE-2026-100348\nCVE-2026-100349\nCVE-2026-100350\nCVE-2026-100351\nCVE-2026-100352\nCVE-2026-100353\nCVE-2026-100354\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"0888f3f1-d9b2-3166-9a1d-213d511f4a98","product":{"name":"hugo-0:0.168.0-0.1.hum1@s390x","vendor":{"name":"Red Hat"}}},{"id":"0d3926a5-07b1-3d2c-bac9-36ef90660fb4","product":{"name":"hugo-0:0.168.0-0.1.hum1@aarch64","vendor":{"name":"Red Hat"}}},{"id":"11faf46b-7717-359a-b011-0aaebeda5b13","product":{"name":"hugo-0:0.168.0-0.1.hum1@src","vendor":{"name":"Red Hat"}}},{"id":"d30ac518-ac4e-39bb-bb9d-1c155212f02f","product":{"name":"Red Hat Hardened Images","vendor":{"name":"Red Hat"}}},{"id":"f21cf517-05c4-3027-9787-c55b17e27cda","product":{"name":"hugo-0:0.168.0-0.1.hum1@x86_64","vendor":{"name":"Red Hat"}}}]}}]}