CVE-2026-97394: 
Chainguard vulnerability analysis and mitigation

CVE-2026-97394 is a nil-pointer dereference vulnerability in kin-openapi (Go package github.com/getkin/kin-openapi), a Go library for handling OpenAPI files. The flaw exists in the openapi3filter package, which accepts OpenAPI 3.1 array schemas lacking an items keyword and subsequently dereferences the nil Schema.Items value during request/response validation, causing a deterministic panic. Affected versions are >= 0.136.0 and < 0.143.0; the issue is fixed in v0.143.0. It carries a CVSS v3.1 base score of 7.5 (High) (Github Advisory).

The root cause is a spec-validation asymmetry between OpenAPI 3.0 and 3.1 (CWE-476: NULL Pointer Dereference; CWE-248: Uncaught Exception). Under OpenAPI 3.0, doc.Validate() rejects array schemas missing items, but under OpenAPI 3.1 (JSON Schema 2020-12), omitting items is legal, so Schema.Items remains nil after a clean validation pass. The vulnerable decoders — UrlencodedBodyDecoder (at req_resp_decoder.go:1421), MultipartBodyDecoder (~line 1564–1579), and parseArray (~line 1129/1151) — all dereference propSchema.Value.Items.Value without a nil guard, triggering a panic on any non-empty application/x-www-form-urlencoded or multipart/form-data request body, or on array-typed response headers. Because openapi3filter contains no recover(), the panic propagates into the calling application and can crash the process if no per-request recovery is in place. JSON request bodies are not affected as they use a different decoder path (Github Advisory, Fix Commit).

Successful exploitation results in a deterministic, 100% reproducible denial of service: every request to an affected operation triggers a nil-pointer panic, crashing the request handler or the entire Go process if no per-request recover() is present. There is no confidentiality or integrity impact — the vulnerability is purely an availability issue. Applications using openapi3filter to validate requests/responses against OpenAPI 3.1 documents with items-less array schemas are at risk, including those where specs are generated by code-generation tools or loaded from untrusted sources (Github Advisory).

No public proof-of-concept exploit code has been released beyond the detailed PoC included in the security advisory itself, and there is no evidence of in-the-wild exploitation at this time. The vulnerability requires no authentication, no privileges, and no user interaction — a single HTTP POST with any non-empty body to an affected endpoint is sufficient to trigger the panic deterministically. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. No threat actor attribution has been reported (Github Advisory).

1. Identify a target: Find a Go application that uses github.com/getkin/kin-openapi versions >= 0.136.0 and < 0.143.0 with openapi3filter.ValidateRequest or ValidateResponse middleware enabled against an OpenAPI 3.1 document.
2. Locate a vulnerable operation: Identify an API endpoint whose OpenAPI 3.1 spec defines a requestBody with application/x-www-form-urlencoded or multipart/form-data content type, where a body property is declared as type: array without an items keyword. Alternatively, target an endpoint with an array-typed response header.
3. Craft the attack request: Send a minimal HTTP POST with a non-empty body to the vulnerable endpoint:

POST /vulnerable-endpoint HTTP/1.1
Host: target
Content-Type: application/x-www-form-urlencoded

tags=a

4. Trigger the panic: The UrlencodedBodyDecoder (or MultipartBodyDecoder) dereferences propSchema.Value.Items.Value with Items == nil during schema inspection before form parsing, causing a runtime error: invalid memory address or nil pointer dereference.
5. Achieve denial of service: The panic propagates out of openapi3filter into the application. Without a per-request recover(), the Go HTTP server logs http: panic serving and aborts the connection; in non-net/http contexts, the process may crash entirely. Repeating the request causes a panic on every attempt (Github Advisory).

• Logs: Go HTTP server logs containing http: panic serving <IP>:<port>: runtime error: invalid memory address or nil pointer dereference with a stack trace referencing openapi3filter.UrlencodedBodyDecoder or openapi3filter.MultipartBodyDecoder in req_resp_decoder.go.
• Logs: Stack traces showing the call chain ValidateRequest → ValidateRequestBody → decodeBody → UrlencodedBodyDecoder or ValidateResponse → ... → parseArray → parsePrimitive.
• Network: Repeated HTTP POST requests to the same endpoint with Content-Type: application/x-www-form-urlencoded or multipart/form-data and minimal non-empty bodies (e.g., tags=a), especially from the same source IP.
• Process: Unexpected Go process crashes or restarts correlated with inbound HTTP requests to specific API endpoints (Github Advisory).

The primary remediation is to upgrade github.com/getkin/kin-openapi to version v0.143.0 or later, which adds nil guards in UrlencodedBodyDecoder, MultipartBodyDecoder, and parseArray before dereferencing Schema.Items (Fix Commit, v0.143.0 Release). As a temporary workaround, ensure all OpenAPI 3.1 array schemas in your specifications include the items keyword, which prevents Schema.Items from being nil. Additionally, adding a per-request recover() in HTTP handlers can prevent process crashes while a patch is applied (Github Advisory).