kin-openapi is a Go project for handling OpenAPI files. Prior to 0.148.0, the OpenAPI 3.1 validation path passes YAML NaN and infinity numeric values to santhosh-tekuri/jsonschema v6.0.2 without applying kin-openapi's existing finite-number…
Exact source revision recorded 30 Oct 2026 01:05:47 UTC. It does not establish the source's current position. Latest evidence.
euvd · EUVD-2026-102161
Publishedkin-openapi is a Go project for handling OpenAPI files. Prior to 0.148.0, the OpenAPI 3.1 validation path passes YAML NaN and infinity numeric values to santhosh-tekuri/jsonschema v6.0.2 without applying kin-openapi's existing finite-number guards. A remote unauthenticated client can send an application/yaml or application/x-yaml request body containing .nan, .inf, or -.inf to an operation with a numeric constraint, causing the dependency to create and dereference a nil big.Rat during ValidateRequest. Standard net/http servers recover the panic per connection, while other hosts or application goroutines may terminate the process. This issue is fixed in version 0.148.0.
EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.
Original publisher date fields
datePublished: Oct 15, 2026, 3:54:25 PM
dateUpdated: Oct 20, 2026, 2:46:20 AM
4 related source bulletins · separate from aliases
RHSA-2026:82637: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
CVE-2026-97394 · CVE-2026-100347 · CVE-2026-100348 · CVE-2026-100349 · CVE-2026-100350 · CVE-2026-100351 · CVE-2026-100352 · CVE-2026-100353 · CVE-2026-100354
RHSA-2026:87077: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
CVE-2026-15577 · CVE-2026-33374 · CVE-2026-92539 · CVE-2026-93294 · CVE-2026-95502 · CVE-2026-100347 · CVE-2026-100348 · CVE-2026-100349 · CVE-2026-100351 · CVE-2026-100352 · CVE-2026-100353 · CVE-2026-100354 · CVE-2026-110816
RHSA-2026:85266: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
CVE-2026-93450 · CVE-2026-100347 · CVE-2026-100348 · CVE-2026-100349 · CVE-2026-100351 · CVE-2026-100352 · CVE-2026-100353 · CVE-2026-100354 · CVE-2026-110816
openSUSE-SU-2026:12164-1: hugo-0.168.0-2.1 on GA media
CVE-2026-100347 · CVE-2026-100348 · CVE-2026-100349 · CVE-2026-100350 · CVE-2026-100351 · CVE-2026-100352
- Source published
- Oct 15, 2026, 3:54:25 PM (timezone not stated)
- Source modified
- Oct 20, 2026, 2:46:20 AM (timezone not stated)
- Observed here
- 30 Oct 2026 01:05:47 UTC
- Source terms
- ENISA EUVD · source terms and attribution apply
Original source record · Cite this exact observation · Complete original publisher JSON
This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.
EUVD CVSS 3.1 · 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H