{"id":"GHSA-mh7x-f8wq-4jhx","revision":"556569bb280e4c4bb645e0f0e80826bc","records":[{"revision":"556569bb280e4c4bb645e0f0e80826bc","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-mh7x-f8wq-4jhx","aliases":["CVE-2026-100348"],"title":"kin-openapi spec loader panics on a self-referential additionalProperties $ref (nil-pointer DoS)","description":"The defect\n----------\nConfirmed at HEAD (f0407d5, v0.144.0). openapi3/loader.go, inside resolveComponent's drill closure (around line 455), the case *SchemaRef branch for pathPart == \"additionalProperties\" dereferences c.Value.AdditionalProperties with no nil-check on c.Value:\n\n    case *SchemaRef:\n        if pathPart == \"additionalProperties\" {\n            if ap := c.Value.AdditionalProperties.Has; ap != nil {   // c.Value can be nil here\n                cursor = *ap\n            } else {\n                cursor = c.Value.AdditionalProperties.Schema\n            }\n            attempted = true\n        }\n\nWhen a $ref fragment drills through .../additionalProperties of a schema whose Value is still nil (a pure, not-yet-resolved $ref, or a self-reference resolved before its own Value is set), c.Value is nil and the .AdditionalProperties access panics.\n\nInput and attacker\n-------------------\nA tiny crafted OpenAPI document, one schema, no external refs, no network:\n\n    openapi: 3.0.3\n    info: {title: t, version: \"1.0.0\"}\n    paths: {}\n    components:\n      schemas:\n        A:\n          $ref: '#/components/schemas/A/additionalProperties'\n\nAttacker model: any service or tool that loads an untrusted spec via the default openapi3.Loader (LoadFromData / LoadFromFile / LoadFromURI), e.g. a spec registry, an API-management platform ingesting user specs, a linter, or a converter. It crashes during LOAD (ResolveRefsIn), before Validate.\n\nVerification level\n------------------\nEXECUTED with negative controls (agent-run go test at HEAD f0407d5, including yesterday's security merge; the bug is still present). The full stack pins LoadFromData:196 -> ResolveRefsIn:274 -> resolveSchemaRef:1048 -> resolveComponent:485 -> drill:439 -> :455, propagating to main(); no recover() in loader.go/schema.go (grep + trace). Two negative controls stay clean: drilling additionalProperties of a resolved schema loads fine (the existing TestIssue376 happy path), and a normal recursive schema loads fine, so the nil Value is specifically the cause. I independently re-confirmed at HEAD that loader.go:455 dereferences c.Value.AdditionalProperties with no nil-check on c.Value. NOT verified: I did not enumerate every consumer's recover posture.\n\nSuggested fix\n-------------\nAdd if c.Value == nil { break } (fall through to the nil-safe drillIntoField) before touching c.Value.AdditionalProperties. One line.\n\nAlso cleared (stated, not claimed)\n----------------------------------\nThe allOf/anyOf $ref diamond does not blow up: Schema.validate threads its stack through the return and never pops it, acting as a global pointer-keyed visited-set (executed N=10..30, microseconds). External-ref SSRF/path-traversal is blocked by default (IsExternalRefsAllowed=false); the known custom-ReadFromURIFunc bypass is the already-banked downstream oasdiff item.\n\nAdvisory-source note\n--------------------\nFive-source enumeration: every kin-openapi advisory (CVE-2025-30153 plus the five fresh July-2026 GHSAs) is in openapi3filter (request validation); this finding is in the openapi3 loader, untouched by that systematic reporter and flagged un-analyzed by the prior oasdiff scout. Not contested on the loader surface as of today (a systematic hunter could pivot, so it decays; submit reasonably promptly).\n\nDedup\n-----\nDedup gate clean: no kin-openapi loader verdict in COVERED-INDEX, DISCLOSURE-INDEX or SCOUT-EXCLUDE (the one DISCLOSURE-INDEX hit is report #313, the downstream oasdiff, a different repo/lane).\n\nTooling\n-------\nAI assistance was used while investigating. The panic is executed-verified with negative controls (a one-schema self-referential additionalProperties $ref crashes LoadFromData while a resolved additionalProperties and a normal recursive schema load fine), and I confirmed at HEAD that loader.go:455 dereferences c.Value.AdditionalProperties with no nil-check on c.Value, on a load path with no recover.","state":0,"publishedAt":"2026-10-15T20:15:58+00:00","modifiedAt":"2026-10-15T20:30:07.0509548+00:00","affected":[{"ecosystem":"Go","name":"github.com/getkin/kin-openapi","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.145.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/getkin/kin-openapi/security/advisories/GHSA-mh7x-f8wq-4jhx","https://nvd.nist.gov/vuln/detail/CVE-2026-100348","https://github.com/getkin/kin-openapi/commit/88aa64c7cbd03ecadbb419c473bdcaa8b0124c6b","https://github.com/getkin/kin-openapi","https://github.com/getkin/kin-openapi/releases/tag/v0.145.0"],"sourceUrl":"https://github.com/advisories/GHSA-mh7x-f8wq-4jhx","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-mh7x-f8wq-4jhx","identifiers":["GHSA-mh7x-f8wq-4jhx","CVE-2026-100348"]},"retained":false,"historicalAffected":[]}],"coverage":[]}