CVE-2026-100352: 
Wolfi vulnerability analysis and mitigation

CVE-2026-100352 is a denial-of-service vulnerability in kin-openapi, a Go library for handling OpenAPI files, caused by YAML NaN and infinity numeric values bypassing finite-number guards in the OAS 3.1 validation path. Affected versions are all releases prior to 0.148.0 of github.com/getkin/kin-openapi. The vulnerability was published on August 27, 2026 (advisory) and added to the NVD on October 15, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (Github Advisory, Red Hat CVE).

The root cause is classified as CWE-754 (Improper Check for Unusual or Exceptional Conditions) and CWE-476 (NULL Pointer Dereference). The built-in schema visitor visitJSON in kin-openapi explicitly guards against NaN and Inf float64 values by returning ErrSchemaInputNaN / ErrSchemaInputInf; however, the OAS 3.1 validation path dispatches through useJSONSchema2020 (openapi3/schema_jsonschema_validator.go:204), which passes values directly to santhosh-tekuri/jsonschema/v6 v6.0.2 without applying these guards. Inside jsonschema/v6 v6.0.2, numValidate attempts to build a *big.Rat via big.Rat.SetString(fmt.Sprintf("%v", v)); for NaN/Inf inputs this silently returns nil, and the subsequent dereference of the nil *big.Rat in Rat.Cmp triggers a Go runtime panic. An unauthenticated attacker exploits this by sending an HTTP POST request with Content-Type: application/yaml (or application/x-yaml) and a body containing .nan, .inf, or -.inf to any endpoint whose OAS 3.1 schema declares a numeric constraint (minimum, maximum, exclusiveMinimum, exclusiveMaximum, or multipleOf) (Github Advisory, GHSA Security Advisory).

The primary impact is denial of service. Under standard Go net/http servers, the panic is recovered per-connection, causing the client to receive a dropped connection (EOF) while the server process survives — but sustained flooding degrades service reliability and generates excessive log noise. On non-net/http hosts or when request validation is performed in application-spawned goroutines (outside the net/http recovery wrapper), a single crafted request causes a full process crash. There is no confidentiality or integrity impact; the vulnerability is purely an availability concern (Github Advisory).

No public proof-of-concept exploit code has been released beyond the detailed reproduction steps included in the security advisory itself, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The attack requires no authentication, no user interaction, and low complexity — a single HTTP request is sufficient to trigger the panic (Github Advisory, Red Hat CVE).

1. Reconnaissance: Identify API services built with github.com/getkin/kin-openapi versions prior to 0.148.0 that use OAS 3.1 specs and accept application/yaml or application/x-yaml request bodies with numeric constraints (e.g., minimum, maximum, multipleOf).
2. Identify target endpoint: Locate an API endpoint that accepts a YAML body with a numeric field constrained by a schema keyword. This information may be available via a publicly exposed OpenAPI spec (e.g., /openapi.yaml or /swagger.yaml).
3. Craft malicious request: Construct an HTTP POST request targeting the vulnerable endpoint with the header Content-Type: application/yaml and a body containing one of the YAML special numeric values: .nan, .inf, or -.inf.
4. Send the request: Transmit the crafted request to the server. The YAML decoder (YamlBodyDecoder) converts the token to math.NaN() or math.Inf(±1), which propagates to useJSONSchema2020, bypassing the NaN/Inf guard and triggering a nil pointer dereference panic in jsonschema/v6 v6.0.2.
5. Observe impact: On net/http servers, the connection is dropped (client receives EOF) and the panic is logged. On non-net/http hosts or goroutine-spawned validation, the entire process crashes. Repeat requests to sustain denial of service (GHSA Security Advisory).

• Network: Repeated HTTP POST requests to YAML-accepting API endpoints with Content-Type: application/yaml or Content-Type: application/x-yaml headers and a body consisting solely of .nan, .inf, or -.inf.
• Logs: Go runtime panic messages in server logs such as http: panic serving <IP>:<port>: runtime error: invalid memory address or nil pointer dereference; stack traces referencing math/big.(*Rat).Cmp, jsonschema/v6.(*validator).numValidate, and openapi3.(*Schema).useJSONSchema2020.
• Process: Unexpected process termination or restart of Go-based API services (on non-net/http hosts); elevated connection reset or EOF errors reported by API clients (GHSA Security Advisory).

The fix is available in kin-openapi version 0.148.0, which bumps the transitive dependency santhosh-tekuri/jsonschema/v6 from v6.0.2 to v6.0.3 — the upstream fix that eliminates the nil *big.Rat dereference. Upgrading to v0.148.0 is the recommended remediation. As a temporary workaround if an immediate upgrade is not possible, implement input validation at the application or API gateway layer to reject application/yaml and application/x-yaml request bodies containing the literal strings .nan, .inf, or -.inf before they reach the kin-openapi validation layer (Github Release, Patch Commit).