CVE-2026-100354: 
Wolfi vulnerability analysis and mitigation

CVE-2026-100354 is an Uncontrolled Recursion vulnerability in getkin/kin-openapi, a Go library for handling OpenAPI files, that allows unauthenticated remote attackers to crash the entire service process via a fatal, unrecoverable stack overflow. The flaw affects all versions prior to 0.149.0 and was first published by the maintainer on August 28, 2026, with NVD publication on October 15, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (Github Advisory).

The root cause (CWE-674: Uncontrolled Recursion) is an asymmetry between spec-time and runtime validation: Schema.validate() uses stack-based cycle detection to safely accept circular allOf/anyOf/oneOf references, but the runtime validators Schema.visitJSON → visitXOFOperations (in openapi3/schema.go) and decodeValue (in openapi3filter/req_resp_decoder.go) contain no equivalent guard. When a request or response is validated against a schema whose combinator chain refers back to itself, these functions recurse infinitely, exhausting the Go goroutine stack and triggering a fatal runtime: goroutine stack exceeds 1000000000-byte limit error. Because this is a fatal Go runtime error rather than a recoverable panic, recover() cannot intercept it, meaning net/http's per-connection recovery mechanism is ineffective and the entire process is terminated. The advisory includes two concrete PoC paths: direct VisitJSON() on a hand-built circular schema (Path A) and an HTTP request to a loaded OAS 3.0 spec with a circular $ref (Path B) (Github Advisory, Fix Commit).

Successful exploitation results in a complete, unrecoverable denial of service for the entire hosting process — not just the individual request goroutine. Because the fatal stack overflow cannot be caught by recover(), all concurrent requests from unrelated clients are also terminated, making the availability impact total (A:H). There is no confidentiality or integrity impact; the vulnerability is purely a DoS primitive. The primary attack surface includes API gateways, mock servers, spec linters, and documentation generators that load OpenAPI specs from untrusted sources, as well as any application serving a fixed spec that inadvertently contains a circular combinator (Github Advisory).

A proof-of-concept is publicly available in the GitHub Security Advisory, providing complete, reproducible steps including a crafted YAML spec and a single HTTP GET request sufficient to crash the target process (Github Advisory). The vulnerability is network-exploitable with no authentication, no privileges, and no user interaction required, and NVD SSVC classifies it as automatable. The EPSS score is 0.0 at time of publication, and there is no evidence of active in-the-wild exploitation or CISA KEV catalog listing as of the advisory date (Github Advisory).

1. Identify target: Locate a service using getkin/kin-openapi prior to v0.149.0 for request or response validation — common in API gateways, mock servers, or spec validators.
2. Craft a circular schema spec: Prepare an OAS 3.0 YAML document where a schema's allOf (or anyOf/oneOf) contains a $ref pointing back to itself, e.g.:

components:
  schemas:
    Recursive:
      type: object
      allOf:
        - $ref: '#/components/schemas/Recursive'
      properties:
        name: {type: string}

3. Deliver the spec (if the target loads external specs): Supply the malicious spec to the target application via an API gateway spec upload, a linter input, or any other mechanism that causes the application to load and validate the document. Note that Validate() will accept it without error.
4. Trigger runtime validation: Send a single HTTP GET request to an endpoint whose parameter schema resolves to the circular reference, e.g., GET /test?data=x. This causes openapi3filter.decodeValue to recurse infinitely through the AllOf chain.
5. Process crash: The Go runtime emits fatal error: stack overflow and terminates the entire process, taking down all concurrent connections. The crash cannot be caught by recover() or net/http's per-connection handler (Github Advisory).

• Logs: Go runtime fatal error messages in application logs: runtime: goroutine stack exceeds 1000000000-byte limit and fatal error: stack overflow, accompanied by repeated stack frames such as github.com/getkin/kin-openapi/openapi3filter.decodeValue at req_resp_decoder.go:278 or github.com/getkin/kin-openapi/openapi3.(*Schema).visitJSON at schema.go:1951.
• Process: Unexpected, non-zero exit code termination of the Go service process without a preceding OS-level signal; process restart events in container orchestration logs (e.g., Kubernetes pod restarts with OOMKilled or crash-loop indicators).
• Network: HTTP requests to endpoints mapped to circular schema parameters (e.g., query parameters referencing a self-referential $ref) immediately preceding a service crash; absence of any HTTP response to the triggering request (Github Advisory).

Upgrade github.com/getkin/kin-openapi to version 0.149.0 or later, which introduces stack-based cycle detection in both visitJSON (via a visitedSchemas pointer-identity map in schemaValidationSettings) and decodeValue (via the new decodeValueGuarded function with a seen stack), returning a clean 400 error instead of crashing (Fix Commit, v0.149.0 Release). As a temporary workaround until patching is possible, implement network-level controls to restrict which sources can supply OpenAPI specs to the application, and audit existing specs for circular allOf/anyOf/oneOf references before deployment. Monitor application logs for fatal stack overflow messages as an indicator of exploitation attempts (Github Advisory).