{"id":"GO-2026-6783","revision":null,"records":[{"revision":"4c256276be8d4dbf8919e93dd2231558","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-100347","aliases":[],"title":"kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static path","description":"kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3filter.ValidationHandler uses the routers/legacy router, which passes an unsupported or non-canonical HTTP method for an existing static path to openapi3.PathItem.GetOperation. The default branch of GetOperation panics before authentication runs, so an unauthenticated remote client can repeatedly send methods such as PROPFIND or lowercase get to abort connections and generate stack-trace log growth. The specific panic requires an exact static path; a concrete path matched only by a templated route does not reach the same sink. This issue is fixed in version 0.145.0.","state":0,"publishedAt":"2026-10-15T15:35:43.874+00:00","modifiedAt":"2026-10-15T16:21:33.027+00:00","affected":[{"ecosystem":"Vendor product","name":"kin-openapi","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"getkin\",\n                    \"product\": \"kin-openapi\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 0.145.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":5.3,"severity":"MEDIUM"}],"references":["https://github.com/getkin/kin-openapi/security/advisories/GHSA-fh4f-47mf-f2gj","https://github.com/getkin/kin-openapi/commit/f1a5b523b82868d2d9be2e116b4e942892be72c3","https://github.com/getkin/kin-openapi/releases/tag/v0.145.0"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-100347","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-100347","identifiers":["CVE-2026-100347"]},"retained":false,"historicalAffected":[]},{"revision":"d9d5f8f1633743428a39b092d7b5a765","observedAt":"2026-11-09T04:15:05.873+00:00","statement":{"source":"euvd","id":"EUVD-2026-102156","aliases":["CVE-2026-100347","GHSA-fh4f-47mf-f2gj"],"title":"kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3filter.ValidationHandler uses the routers/legacy router, which passes an unsupported or non-canonical HTTP method for an existing static path to openapi3.Path…","description":"kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3filter.ValidationHandler uses the routers/legacy router, which passes an unsupported or non-canonical HTTP method for an existing static path to openapi3.PathItem.GetOperation. The default branch of GetOperation panics before authentication runs, so an unauthenticated remote client can repeatedly send methods such as PROPFIND or lowercase get to abort connections and generate stack-trace log growth. The specific panic requires an exact static path; a concrete path matched only by a templated route does not reach the same sink. This issue is fixed in version 0.145.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":5.3,"severity":null}],"references":["https://github.com/getkin/kin-openapi/security/advisories/GHSA-fh4f-47mf-f2gj","https://github.com/getkin/kin-openapi/commit/f1a5b523b82868d2d9be2e116b4e942892be72c3","https://github.com/getkin/kin-openapi/releases/tag/v0.145.0"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-102156","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Oct 15, 2026, 3:35:43 PM","dateUpdated":"Oct 15, 2026, 4:21:33 PM"},"relatedAdvisories":[{"id":"RHSA-2026:85266","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2026-93450","CVE-2026-100347","CVE-2026-100348","CVE-2026-100349","CVE-2026-100351","CVE-2026-100352","CVE-2026-100353","CVE-2026-100354","CVE-2026-110816"]},{"id":"RHSA-2026:76677","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","vulnerabilityIds":["CVE-2024-24786","CVE-2026-56851","CVE-2026-61801","CVE-2026-95502","CVE-2026-97394","CVE-2026-100347","CVE-2026-100348","CVE-2026-100349","CVE-2026-100350","CVE-2026-100351","CVE-2026-101899","CVE-2026-109855"]},{"id":"openSUSE-SU-2026:12164-1","title":"hugo-0.168.0-2.1 on GA media","vulnerabilityIds":["CVE-2026-100347","CVE-2026-100348","CVE-2026-100349","CVE-2026-100350","CVE-2026-100351","CVE-2026-100352"]},{"id":"RHSA-2026:87077","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2026-15577","CVE-2026-33374","CVE-2026-92539","CVE-2026-93294","CVE-2026-95502","CVE-2026-100347","CVE-2026-100348","CVE-2026-100349","CVE-2026-100351","CVE-2026-100352","CVE-2026-100353","CVE-2026-100354","CVE-2026-110816"]},{"id":"RHSA-2026:82637","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","vulnerabilityIds":["CVE-2026-97394","CVE-2026-100347","CVE-2026-100348","CVE-2026-100349","CVE-2026-100350","CVE-2026-100351","CVE-2026-100352","CVE-2026-100353","CVE-2026-100354"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-102156","identifiers":["EUVD-2026-102156","CVE-2026-100347","GHSA-fh4f-47mf-f2gj"]},"retained":false,"historicalAffected":[]},{"revision":"e6f4f16de038401cb3fca0c4d8b2ac64","observedAt":"2026-10-25T04:17:26.915+00:00","statement":{"source":"nvd","id":"CVE-2026-100347","aliases":[],"title":"kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3filter.ValidationHandler uses the routers/legacy router, which passes an unsupported or non-canonical HTTP method for an existing static path to openapi3.Path…","description":"kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3filter.ValidationHandler uses the routers/legacy router, which passes an unsupported or non-canonical HTTP method for an existing static path to openapi3.PathItem.GetOperation. The default branch of GetOperation panics before authentication runs, so an unauthenticated remote client can repeatedly send methods such as PROPFIND or lowercase get to abort connections and generate stack-trace log growth. The specific panic requires an exact static path; a concrete path matched only by a templated route does not reach the same sink. This issue is fixed in version 0.145.0.","state":0,"publishedAt":"2026-10-15T16:17:30.287+00:00","modifiedAt":"2026-10-15T17:17:07.413+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":5.3,"severity":"MEDIUM"}],"references":["https://github.com/getkin/kin-openapi/commit/f1a5b523b82868d2d9be2e116b4e942892be72c3","https://github.com/getkin/kin-openapi/releases/tag/v0.145.0","https://github.com/getkin/kin-openapi/security/advisories/GHSA-fh4f-47mf-f2gj"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-100347","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-20","CWE-248"],"productCriteria":[],"sourceDates":{"published":"2026-10-15T16:17:30.287","lastModified":"2026-10-15T17:17:07.413"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-100347","identifiers":["CVE-2026-100347"]},"retained":false,"historicalAffected":[]},{"revision":"c24b16a180c242a098d6bc10039bddab","observedAt":"2026-11-05T23:38:32.248+00:00","statement":{"source":"osv","id":"GHSA-fh4f-47mf-f2gj","aliases":["CVE-2026-100347","GO-2026-6783"],"title":"kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static path","description":"## Summary\nThe `openapi3filter.ValidationHandler` (the exported, documented request-validation middleware) hard-wires the legacy router (`routers/legacy`). That router matches the incoming request method verbatim against a trie built exclusively from upper-cased canonical HTTP methods. A request carrying a method token that is not one of the 9 standard methods — a legitimate-but-unsupported token such as `PROPFIND`, or a non-canonical case variant such as lowercase `get` — misses the trie, leaves `route == nil`, and for an existing **static** path falls through to `PathItem.GetOperation(method)`, whose `default:` case calls `panic(...)`. The panic fires inside route resolution, **before any authentication** runs. This is an unauthenticated, remotely triggerable denial of service (recovered per-connection panic + unbounded error-log growth).\n\n## Root Cause\n- `openapi3filter/validation_handler.go:39` — `ValidationHandler.Load()` always constructs `legacyrouter.NewRouter(doc)`; there is no alternative router option on this path.\n- `routers/legacy/router.go:109` — the request method is used verbatim (`method, url := req.Method, ...`); there is no canonicalization or rejection of unknown method tokens.\n- `routers/legacy/router.go:69-70` — the trie is populated with `strings.ToUpper(method)` keys taken from `pathItem.Operations()` (canonical `http.Method*` constants only).\n- `routers/legacy/router.go:141` — `root.Match(method + \" \" + remainingPath)` misses for a non-canonical/unsupported method → `route == nil`.\n- `routers/legacy/router.go:146-150` — in the `route == nil` block, `doc.Paths.Value(path)` returns non-nil for an existing static path, and control reaches `pathItem.GetOperation(method)`.\n- `openapi3/path_item.go:174` — `GetOperation`'s `switch method` has no matching case → `default: panic(fmt.Errorf(\"unsupported HTTP method %q\", method))`.\n\n## Impact\nAn unauthenticated attacker sends a single request with a non-standard HTTP method token to any existing static path. The handler goroutine panics; Go's `net/http` recovers the panic per connection (process survives), aborts the connection (client sees a reset / 500), and logs a full stack trace. Repeated requests cause connection churn and unbounded `http: panic serving` log growth, and the request never reaches authentication. Availability impact (A:L) under the default synchronous `ValidationHandler` middleware; on non-net/http hosts or when reached on an application goroutine the ceiling is a full crash.\n\n## Proof of Concept\nServe any spec with a static path (e.g. `/ping`) behind `openapi3filter.ValidationHandler`, then:\n```\nprintf 'PROPFIND /ping HTTP/1.1\\r\\nHost: x\\r\\n\\r\\n' | nc target 8080   # connection aborted (panic)\nprintf 'get /ping HTTP/1.1\\r\\nHost: x\\r\\n\\r\\n'      | nc target 8080   # connection aborted (panic)\nprintf 'GET /ping HTTP/1.1\\r\\nHost: x\\r\\n\\r\\n'      | nc target 8080   # 200 OK (process survived)\n```\nReproduced end-to-end against a real `net/http.Server` + `ValidationHandler`: `PROPFIND /ping` and lowercase `get /ping` both abort the connection with a panic at `path_item.go:174` (stack: `GetOperation` <- `legacy.FindRoute` router.go:150 <- `ValidationHandler.validateRequest` validation_handler.go:84); the process stays alive and subsequent `GET /ping` returns 200.\n\n## Attack Chain\n1. Entry: unauthenticated `PROPFIND /ping HTTP/1.1` (any known static path). Guard: net/http method validation. Bypass proof: net/http accepts any valid HTTP token as a method — `PROPFIND` and lowercase `get` both reach the handler.\n2. Route match: `legacy/router.go:141` `root.Match(\"PROPFIND /ping\")`. Guard: trie match. Bypass proof: trie holds only upper-cased canonical methods → miss → `route == nil`.\n3. `route == nil` block: `router.go:146` `doc.Paths.Value(\"/ping\")` → non-nil for an existing static path (exact map lookup). Guard: `pathItem == nil` check (l.147). Bypass proof: static path exists → not nil → proceeds.\n4. Sink: `router.go:150` `pathItem.GetOperation(\"PROPFIND\")` → `path_item.go:174` `default: panic(...)`.\n5. Impact: handler goroutine panics; net/http recovers per connection; request never reaches auth.\n\n## Bypass Evidence\n- net/http does NOT reject non-standard method tokens — confirmed empirically: `PROPFIND` and lowercase `get` both reached the handler and panicked.\n- No canonicalization/rejection exists between `FindRoute` entry and `GetOperation`; `req.Method` is used verbatim (router.go:109).\n- `git show v0.144.0:openapi3/path_item.go` shows `panic(...)` at line 174; `git show v0.144.0:routers/legacy/router.go` shows verbatim method use and the unguarded `GetOperation` call. `git log v0.144.0..HEAD` on these files is empty (no post-tag fix).\n\n## Scoping Note\nThe panic requires the request path to be an exact static (non-templated) key in the served spec. A concrete path against a `/{id}` template returns a clean 500 (not a panic), because `Paths.Value` is an exact map lookup. Static paths (`/health`, `/login`, `/version`, `/metrics`, `/ping`, `/`) are ubiquitous in real specs and discoverable from public specs/standard endpoints, so a vulnerable target almost always exists. This makes the finding arguably broader than existing panic advisories, as it needs no special spec construct — any static path suffices.\n\n## Affected Versions\n`<= 0.144.0` (present on the latest release tag v0.144.0; long-standing; no patched version).\n\n## Suggested Fix\nIn the legacy router, canonicalize/validate the request method before route resolution and return `ErrMethodNotAllowed`/`ErrPathNotFound` for unknown methods, or make `PathItem.GetOperation` return an error (nil) for unrecognized methods instead of calling `panic`.\n\n---\nReported by **zx (Jace)** — GitHub: @manus-use","state":0,"publishedAt":"2026-10-15T20:15:48+00:00","modifiedAt":"2026-11-05T23:25:50.432368+00:00","affected":[{"ecosystem":"Go","name":"github.com/getkin/kin-openapi","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.145.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/getkin/kin-openapi/security/advisories/GHSA-fh4f-47mf-f2gj","https://nvd.nist.gov/vuln/detail/CVE-2026-100347","https://github.com/getkin/kin-openapi/commit/f1a5b523b82868d2d9be2e116b4e942892be72c3","https://github.com/getkin/kin-openapi","https://github.com/getkin/kin-openapi/releases/tag/v0.145.0"],"sourceUrl":"https://github.com/advisories/GHSA-fh4f-47mf-f2gj","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-fh4f-47mf-f2gj","identifiers":["GHSA-fh4f-47mf-f2gj","CVE-2026-100347","GO-2026-6783"]},"retained":false,"historicalAffected":[]},{"revision":"ecedc68f6f244909aca4e08b69a36ddc","observedAt":"2026-11-05T23:38:32.248+00:00","statement":{"source":"osv","id":"GO-2026-6783","aliases":["CVE-2026-100347","GHSA-fh4f-47mf-f2gj"],"title":"kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static path in github.com/getkin/kin-openapi","description":"kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static path in github.com/getkin/kin-openapi","state":0,"publishedAt":"2026-11-05T22:53:53+00:00","modifiedAt":"2026-11-05T23:15:12.6526909+00:00","affected":[{"ecosystem":"Go","name":"github.com/getkin/kin-openapi","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.145.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/getkin/kin-openapi/security/advisories/GHSA-fh4f-47mf-f2gj","https://nvd.nist.gov/vuln/detail/CVE-2026-100347","https://github.com/getkin/kin-openapi/commit/f1a5b523b82868d2d9be2e116b4e942892be72c3","https://github.com/getkin/kin-openapi/releases/tag/v0.145.0"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6783","license":"OSV · upstream source license applies","key":"osv:GO-2026-6783","identifiers":["GO-2026-6783","CVE-2026-100347","GHSA-fh4f-47mf-f2gj"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-09T15:04:17.9226009+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-09T15:04:17.9226009+00:00","lastSuccessAt":"2026-11-09T15:04:18.1621362+00:00","error":null,"lastVerifiedAt":"2026-11-09T15:04:18.1621395+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-24e6fde7b744113daefb8f6135035fb8a5c69c9617c9c0d40574a0376532ffd3-49ad16fb0d34ddf0ae41aa46fedfe58e1df7005677e5f3c7ea3ce3ccbb1e0589","complete":true,"records":421457,"lastAttemptAt":"2026-11-09T15:02:15.2169676+00:00","lastSuccessAt":"2026-11-09T15:02:15.1121329+00:00","error":null,"lastVerifiedAt":"2026-11-09T15:02:15.2169676+00:00","snapshotPublishedAt":"2026-11-09T14:25:18+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-1cda4ef84588402c81419af30caa5cf1","complete":false,"records":13655,"lastAttemptAt":"2026-11-09T15:16:31.927767+00:00","lastSuccessAt":"2026-11-09T15:16:31.919+00:00","error":"9 identifier lookups failed; latest failures include HTTP 403. Other identifiers were checked independently.","lastVerifiedAt":"2026-11-09T15:16:31.919+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13698,"expectedIdentifiers":13707,"failedIdentifiers":9},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-09T15:04:17.9226009+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-09T15:04:17.9226009+00:00","lastSuccessAt":"2026-11-09T15:04:18.1628494+00:00","error":null,"lastVerifiedAt":"2026-11-09T15:04:18.1628497+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-122e73413fbf41e4b6ede4e4f5660885","complete":true,"records":13667,"lastAttemptAt":"2026-11-09T15:04:19.7498555+00:00","lastSuccessAt":"2026-11-09T15:04:19.744+00:00","error":null,"lastVerifiedAt":"2026-11-09T15:04:19.744+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13707,"expectedIdentifiers":13707,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-980593e6977a6d1b4fb1eed5a1ffe88a468736f89f0a06f710924ad59132c023","complete":true,"records":9914,"lastAttemptAt":"2026-11-09T15:04:17.5233893+00:00","lastSuccessAt":"2026-11-08T11:07:07.068788+00:00","error":null,"lastVerifiedAt":"2026-11-09T15:04:17.5233893+00:00","snapshotPublishedAt":"2026-11-08T11:02:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-09T15:02:16.0914115+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-09T15:02:16.0914115+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-c905fa1bd26c7b261e77cc7202a86dc766ff31c2b096b501f3bf44f561e34970","complete":true,"records":3063,"lastAttemptAt":"2026-11-09T15:04:17.8913143+00:00","lastSuccessAt":"2026-11-09T12:02:21.7931207+00:00","error":null,"lastVerifiedAt":"2026-11-09T15:04:17.8913143+00:00","snapshotPublishedAt":"2026-11-09T11:18:00+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-c5775280c9de3927e2aad763cbfbebcc2ac79b903f8410c65ab9bc1096f5fa3d","complete":true,"records":231299,"lastAttemptAt":"2026-11-09T15:04:17.3926133+00:00","lastSuccessAt":"2026-11-09T15:04:15.9950254+00:00","error":null,"lastVerifiedAt":"2026-11-09T15:04:17.3926133+00:00","snapshotPublishedAt":"2026-11-09T14:33:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}