CVE-2026-100353: 
Wolfi vulnerability analysis and mitigation

CVE-2026-100353 is a NULL Pointer Dereference (CWE-476) vulnerability in kin-openapi, a Go library for handling OpenAPI files. It represents an incomplete fix for a prior advisory (GHSA-p6wj-qrr4-pgh5), leaving three decoder paths in openapi3filter unguarded against nil items schemas in legal OpenAPI 3.1 array definitions. Affected versions are >= 0.136.0 and < 0.149.0 of github.com/getkin/kin-openapi. The vulnerability was published on August 28, 2026, and assigned a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory).

The root cause (CWE-476) is the absence of nil-items guards in three decoder paths that were overlooked when fixing GHSA-p6wj-qrr4-pgh5. Specifically, urlValuesDecoder.parseArray (req_resp_decoder.go:576) and buildResObj (req_resp_decoder.go:1015) lack checks for a nil Items field before dereferencing it. Three exploitable paths exist: (1) a query parameter declared as type: array with no items keyword triggers urlValuesDecoder.parseArray → parseValue → nil dereference; (2) a deepObject query parameter containing an array property with no items triggers buildResObj recursing with a nil SchemaRef; (3) a application/x-www-form-urlencoded body with an array property inside an allOf/anyOf/oneOf sub-schema bypasses the top-level guard added by the prior fix via decodeSchemaConstructs → decodeProperty → urlValuesDecoder.parseArray. All three paths are reachable by an unauthenticated remote client with a single crafted HTTP request, and each produces a deterministic panic (GitHub Advisory, Fix Commit).

The vulnerability causes a Denial of Service (DoS) with no impact on confidentiality or integrity. The severity of the availability impact depends on the deployment: under a standard net/http server, Go's per-connection panic recovery limits the effect to dropping the individual connection (per-request DoS), while non-net/http hosts (e.g., fasthttp, connect adapters) or applications that invoke validation in a spawned goroutine will experience a full process crash. Any application using openapi3filter.ValidateRequest against an OAS 3.1 spec that legally declares an array schema without an items keyword is affected (GitHub Advisory).

No public proof-of-concept exploit code has been released, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability requires no authentication, no privileges, and no user interaction, making it trivially exploitable by any remote client that can send HTTP requests to an affected service. The EPSS score is 0.0, reflecting the current absence of observed exploitation activity. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Identify target: Locate a service that uses github.com/getkin/kin-openapi versions >= 0.136.0, < 0.149.0 with openapi3filter.ValidateRequest enabled, and whose OpenAPI 3.1 spec declares an array schema without an items keyword.
2. Craft Path 1 (query array): Send a GET request with a repeated query parameter matching the array field, e.g., GET /endpoint?ids=1&ids=2. The urlValuesDecoder.parseArray method will attempt to dereference the nil Items schema and panic.
3. Craft Path 2 (deepObject array): Send a GET request using deepObject notation for a parameter whose object contains an array property with no items, e.g., GET /endpoint?filter[tags][0]=a. This triggers buildResObj to recurse with a nil SchemaRef.
4. Craft Path 3 (urlencoded allOf body): Send a POST request with Content-Type: application/x-www-form-urlencoded and a body containing an array field defined inside an allOf/anyOf/oneOf sub-schema, e.g., tags=a&tags=b. The decodeSchemaConstructs walker bypasses the top-level nil guard and reaches urlValuesDecoder.parseArray with a nil Items.
5. Observe impact: On non-net/http hosts or goroutine-based validation, the process crashes. On standard net/http servers, the connection is dropped and an error is logged as http: panic serving ... (GitHub Advisory).

• Logs: Go runtime panic messages in application logs containing runtime error: invalid memory address or nil pointer dereference with stack frames referencing openapi3filter.(*urlValuesDecoder).parseValue, openapi3filter.(*urlValuesDecoder).parseArray, or openapi3filter.buildResObj in req_resp_decoder.go.
• Logs: net/http server logs containing http: panic serving <client-ip>: runtime error: invalid memory address or nil pointer dereference following requests with array-type query parameters or urlencoded bodies.
• Network: Repeated GET requests to the same endpoint with multi-value query parameters (e.g., ?param=val1&param=val2) or deepObject-style parameters (e.g., ?obj[field][0]=val) from the same source IP, especially if followed by connection resets.
• Network: Repeated POST requests with Content-Type: application/x-www-form-urlencoded bodies containing repeated keys (e.g., tags=a&tags=b) targeting endpoints that perform OpenAPI request validation.
• Process: Unexpected process termination or restart of the Go application service, particularly correlated with the above network patterns (GitHub Advisory).

Upgrade github.com/getkin/kin-openapi to version v0.149.0 or later, which adds nil-items guards to urlValuesDecoder.parseArray and buildResObj (Fix Commit, Release v0.149.0). If immediate patching is not possible, implement upstream input validation or a WAF/API gateway rule to reject requests with array-type query parameters, deepObject parameters, or urlencoded bodies with repeated keys before they reach the validation layer. Alternatively, restrict network-level access to affected endpoints to trusted clients only (GitHub Advisory).