{ "document": { "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this portal to enhance access to its information and vulnerabilities. The use of this information is subject to the following terms and conditions:\n\nThe vulnerabilities disclosed in this portal are gathered by NCSC-NL from a variety of open sources, which the user can retrieve from other platforms. NCSC-NL makes every reasonable effort to ensure that the content of this portal is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or real-time keeping up-to-date. NCSC-NL does not control nor guarantee the accuracy, relevance, timeliness or completeness of information obtained from these external sources. The vulnerabilities disclosed in this portal are intended solely for the convenience of professional parties to take appropriate measures to manage the risks posed to the cybersecurity. No rights can be derived from the information provided therein.\n\nNCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of the vulnerabilities disclosed in this portal. This includes damage resulting from the inaccuracy of incompleteness of the information contained in it.\nThe information on this page is subject to Dutch law. All disputes related to or arising from the use of this portal regarding the disclosure of vulnerabilities will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings." } ], "publisher": { "category": "coordinator", "contact_details": "cert@ncsc.nl", "name": "National Cyber Security Centre", "namespace": "https://www.ncsc.nl/" }, "title": "CVE-2026-100352", "tracking": { "current_release_date": "2026-10-26T18:57:36.216128Z", "generator": { "date": "2026-02-17T15:00:00Z", "engine": { "name": "V.E.L.M.A", "version": "1.7" } }, "id": "CVE-2026-100352", "initial_release_date": "2026-10-15T17:06:24.575550Z", "revision_history": [ { "date": "2026-10-15T17:06:24.575550Z", "number": "1", "summary": "CVE created.| Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (3).| CWES updated (1)." }, { "date": "2026-10-15T17:06:33.813406Z", "number": "2", "summary": "NCSC Score created." }, { "date": "2026-10-15T20:40:08.433114Z", "number": "3", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (5).| CWES updated (1)." }, { "date": "2026-10-15T20:40:12.464654Z", "number": "4", "summary": "NCSC Score updated." }, { "date": "2026-10-16T00:28:55.977350Z", "number": "5", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (6).| Product Identifiers created (1).| References created (5).| CWES updated (1).| Vendor_assessment created." }, { "date": "2026-10-16T00:28:58.880129Z", "number": "6", "summary": "NCSC Score updated." }, { "date": "2026-10-16T18:43:54.683583Z", "number": "7", "summary": "Source created.| CVE status created. (valid)| Description created for source.| Products connected (1)." }, { "date": "2026-10-18T00:31:38.070491Z", "number": "8", "summary": "NCSC Score updated." }, { "date": "2026-10-19T18:13:33.460347Z", "number": "9", "summary": "CVSS created.| CWES created (1).| Products created (1).| References created (3).| Description created for source.| Unknown change." }, { "date": "2026-10-19T18:13:35.965968Z", "number": "10", "summary": "NCSC Score updated." }, { "date": "2026-10-19T21:36:39.226475Z", "number": "11", "summary": "CVSS created.| CWES created (1).| Products created (151).| References created (5).| Description created for source.| Unknown change." }, { "date": "2026-10-20T03:39:02.573606Z", "number": "12", "summary": "Unknown change." }, { "date": "2026-10-20T07:30:54.663870Z", "number": "13", "summary": "EPSS created.| Unknown change." }, { "date": "2026-10-20T07:40:02.185982Z", "number": "14", "summary": "NCSC Score updated." }, { "date": "2026-10-20T10:47:44.908784Z", "number": "15", "summary": "CVSS created.| CWES created (1).| Products created (1).| References created (4).| Description created for source.| Unknown change." }, { "date": "2026-10-21T00:52:37.554032Z", "number": "16", "summary": "Source connected.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (2).| Product Remediations created (2).| Product Identifiers created (4).| Product Identifiers removed (4).| References created (19).| CWES updated (1)." }, { "date": "2026-10-21T00:52:49.682806Z", "number": "17", "summary": "NCSC Score updated." }, { "date": "2026-10-22T13:51:44.225917Z", "number": "18", "summary": "Source connected.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (2).| Product Remediations created (2).| Product Identifiers created (4).| Product Identifiers removed (4).| References created (23).| CWES updated (1)." }, { "date": "2026-10-22T13:51:46.093254Z", "number": "19", "summary": "NCSC Score updated." }, { "date": "2026-10-25T15:15:43.119156Z", "number": "20", "summary": "EPSS updated." }, { "date": "2026-10-26T18:57:25.552311Z", "number": "21", "summary": "Products connected (1).| Products removed (1)." }, { "date": "2026-10-26T18:57:27.764520Z", "number": "22", "summary": "NCSC Score updated." } ], "status": "interim", "version": "22" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:rpm/1", "product": { "name": "vers:rpm/1", "product_id": "CSAFPID-6014972", "product_identification_helper": { "cpe": "cpe:/a:redhat:hummingbird:1" } } } ], "category": "product_name", "name": "Red Hat Hardened Images" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-9710183" } } ], "category": "product_name", "name": "go-fdo-server" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-8902830" } } ], "category": "product_name", "name": "grafana12.4" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/13.1.8-0.3.hum1", "product": { "name": "vers:rpm/13.1.8-0.3.hum1", "product_id": "CSAFPID-9821941", "product_identification_helper": { "purl": "pkg:rpm/redhat/grafana13.1@13.1.8-0.3.hum1?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms" } } }, { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-8902831" } } ], "category": "product_name", "name": "grafana13.1" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/13.2.3-0.3.hum1", "product": { "name": "vers:rpm/13.2.3-0.3.hum1", "product_id": "CSAFPID-9764774", "product_identification_helper": { "purl": "pkg:rpm/redhat/grafana13.2@13.2.3-0.3.hum1?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms" } } }, { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-9053231" } } ], "category": "product_name", "name": "grafana13.2" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-9053232" } } ], "category": "product_name", "name": "hugo" } ], "category": "product_family", "name": "Red Hat Hardened Images" } ], "category": "vendor", "name": "Red Hat" }, { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:deb/unknown", "product": { "name": "vers:deb/unknown", "product_id": "CSAFPID-8980229" } } ], "category": "product_name", "name": "golang-github-getkin-kin-openapi" } ], "category": "product_family", "name": "bookworm" } ], "category": "vendor", "name": "debian" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/<0.148.0", "product": { "name": "vers:unknown/<0.148.0", "product_id": "CSAFPID-9734950" } }, { "category": "product_version_range", "name": "vers:unknown/>=0|<0.148.0", "product": { "name": "vers:unknown/>=0|<0.148.0", "product_id": "CSAFPID-9743000" } }, { "category": "product_version_range", "name": "vers:unknown/v0.1.0", "product": { "name": "vers:unknown/v0.1.0", "product_id": "CSAFPID-3787747" } }, { "category": "product_version_range", "name": "vers:unknown/v0.10.0", "product": { "name": "vers:unknown/v0.10.0", "product_id": "CSAFPID-3787748" } }, { "category": "product_version_range", "name": "vers:unknown/v0.100.0", "product": { "name": "vers:unknown/v0.100.0", "product_id": "CSAFPID-3787749" } }, { "category": "product_version_range", "name": "vers:unknown/v0.101.0", "product": { "name": "vers:unknown/v0.101.0", "product_id": "CSAFPID-3787750" } }, { "category": "product_version_range", "name": "vers:unknown/v0.102.0", "product": { "name": "vers:unknown/v0.102.0", "product_id": "CSAFPID-3787751" } }, { "category": "product_version_range", "name": "vers:unknown/v0.103.0", "product": { "name": "vers:unknown/v0.103.0", "product_id": "CSAFPID-3787752" } }, { "category": "product_version_range", "name": "vers:unknown/v0.104.0", "product": { "name": "vers:unknown/v0.104.0", "product_id": "CSAFPID-3787753" } }, { "category": "product_version_range", "name": "vers:unknown/v0.105.0", "product": { "name": "vers:unknown/v0.105.0", "product_id": "CSAFPID-3787754" } }, { "category": "product_version_range", "name": "vers:unknown/v0.106.0", "product": { "name": "vers:unknown/v0.106.0", "product_id": "CSAFPID-3787755" } }, { "category": "product_version_range", "name": "vers:unknown/v0.107.0", "product": { "name": "vers:unknown/v0.107.0", "product_id": "CSAFPID-3787756" } }, { "category": "product_version_range", "name": "vers:unknown/v0.108.0", "product": { "name": "vers:unknown/v0.108.0", "product_id": "CSAFPID-3787757" } }, { "category": "product_version_range", "name": "vers:unknown/v0.109.0", "product": { "name": "vers:unknown/v0.109.0", "product_id": "CSAFPID-3787758" } }, { "category": "product_version_range", "name": "vers:unknown/v0.11.0", "product": { "name": "vers:unknown/v0.11.0", "product_id": "CSAFPID-3787759" } }, { "category": "product_version_range", "name": "vers:unknown/v0.110.0", "product": { "name": "vers:unknown/v0.110.0", "product_id": "CSAFPID-3787760" } }, { "category": "product_version_range", "name": "vers:unknown/v0.111.0", "product": { "name": "vers:unknown/v0.111.0", "product_id": "CSAFPID-3787761" } }, { "category": "product_version_range", "name": "vers:unknown/v0.112.0", "product": { "name": "vers:unknown/v0.112.0", "product_id": "CSAFPID-3787762" } }, { "category": "product_version_range", "name": "vers:unknown/v0.113.0", "product": { "name": "vers:unknown/v0.113.0", "product_id": "CSAFPID-3787763" } }, { "category": "product_version_range", "name": "vers:unknown/v0.114.0", "product": { "name": "vers:unknown/v0.114.0", "product_id": "CSAFPID-3787764" } }, { "category": "product_version_range", "name": "vers:unknown/v0.115.0", "product": { "name": "vers:unknown/v0.115.0", "product_id": "CSAFPID-3787765" } }, { "category": "product_version_range", "name": "vers:unknown/v0.116.0", "product": { "name": "vers:unknown/v0.116.0", "product_id": "CSAFPID-3787766" } }, { "category": "product_version_range", "name": "vers:unknown/v0.117.0", "product": { "name": "vers:unknown/v0.117.0", "product_id": "CSAFPID-3787767" } }, { "category": "product_version_range", "name": "vers:unknown/v0.118.0", "product": { "name": "vers:unknown/v0.118.0", "product_id": "CSAFPID-3787768" } }, { "category": "product_version_range", "name": "vers:unknown/v0.119.0", "product": { "name": "vers:unknown/v0.119.0", "product_id": "CSAFPID-3787769" } }, { "category": "product_version_range", "name": "vers:unknown/v0.12.0", "product": { "name": "vers:unknown/v0.12.0", "product_id": "CSAFPID-3787770" } }, { "category": "product_version_range", "name": "vers:unknown/v0.120.0", "product": { "name": "vers:unknown/v0.120.0", "product_id": "CSAFPID-3787771" } }, { "category": "product_version_range", "name": "vers:unknown/v0.121.0", "product": { "name": "vers:unknown/v0.121.0", "product_id": "CSAFPID-3787772" } }, { "category": "product_version_range", "name": "vers:unknown/v0.122.0", "product": { "name": "vers:unknown/v0.122.0", "product_id": "CSAFPID-3787773" } }, { "category": "product_version_range", "name": "vers:unknown/v0.123.0", "product": { "name": "vers:unknown/v0.123.0", "product_id": "CSAFPID-3787774" } }, { "category": "product_version_range", "name": "vers:unknown/v0.124.0", "product": { "name": "vers:unknown/v0.124.0", "product_id": "CSAFPID-3787775" } }, { "category": "product_version_range", "name": "vers:unknown/v0.125.0", "product": { "name": "vers:unknown/v0.125.0", "product_id": "CSAFPID-3787776" } }, { "category": "product_version_range", "name": "vers:unknown/v0.126.0", "product": { "name": "vers:unknown/v0.126.0", "product_id": "CSAFPID-3787777" } }, { "category": "product_version_range", "name": "vers:unknown/v0.127.0", "product": { "name": "vers:unknown/v0.127.0", "product_id": "CSAFPID-3787778" } }, { "category": "product_version_range", "name": "vers:unknown/v0.128.0", "product": { "name": "vers:unknown/v0.128.0", "product_id": "CSAFPID-3787779" } }, { "category": "product_version_range", "name": "vers:unknown/v0.129.0", "product": { "name": "vers:unknown/v0.129.0", "product_id": "CSAFPID-3787780" } }, { "category": "product_version_range", "name": "vers:unknown/v0.13.0", "product": { "name": "vers:unknown/v0.13.0", "product_id": "CSAFPID-3787781" } }, { "category": "product_version_range", "name": "vers:unknown/v0.130.0", "product": { "name": "vers:unknown/v0.130.0", "product_id": "CSAFPID-3787782" } }, { "category": "product_version_range", "name": "vers:unknown/v0.131.0", "product": { "name": "vers:unknown/v0.131.0", "product_id": "CSAFPID-8978171" } }, { "category": "product_version_range", "name": "vers:unknown/v0.132.0", "product": { "name": "vers:unknown/v0.132.0", "product_id": "CSAFPID-8978170" } }, { "category": "product_version_range", "name": "vers:unknown/v0.133.0", "product": { "name": "vers:unknown/v0.133.0", "product_id": "CSAFPID-8978169" } }, { "category": "product_version_range", "name": "vers:unknown/v0.134.0", "product": { "name": "vers:unknown/v0.134.0", "product_id": "CSAFPID-8978168" } }, { "category": "product_version_range", "name": "vers:unknown/v0.135.0", "product": { "name": "vers:unknown/v0.135.0", "product_id": "CSAFPID-8978167" } }, { "category": "product_version_range", "name": "vers:unknown/v0.136.0", "product": { "name": "vers:unknown/v0.136.0", "product_id": "CSAFPID-8978166" } }, { "category": "product_version_range", "name": "vers:unknown/v0.137.0", "product": { "name": "vers:unknown/v0.137.0", "product_id": "CSAFPID-8978165" } }, { "category": "product_version_range", "name": "vers:unknown/v0.138.0", "product": { "name": "vers:unknown/v0.138.0", "product_id": "CSAFPID-8978164" } }, { "category": "product_version_range", "name": "vers:unknown/v0.139.0", "product": { "name": "vers:unknown/v0.139.0", "product_id": "CSAFPID-8978163" } }, { "category": "product_version_range", "name": "vers:unknown/v0.14.0", "product": { "name": "vers:unknown/v0.14.0", "product_id": "CSAFPID-3787783" } }, { "category": "product_version_range", "name": "vers:unknown/v0.140.0", "product": { "name": "vers:unknown/v0.140.0", "product_id": "CSAFPID-8978162" } }, { "category": "product_version_range", "name": "vers:unknown/v0.141.0", "product": { "name": "vers:unknown/v0.141.0", "product_id": "CSAFPID-8978161" } }, { "category": "product_version_range", "name": "vers:unknown/v0.142.0", "product": { "name": "vers:unknown/v0.142.0", "product_id": "CSAFPID-8978160" } }, { "category": "product_version_range", "name": "vers:unknown/v0.143.0", "product": { "name": "vers:unknown/v0.143.0", "product_id": "CSAFPID-8978159" } }, { "category": "product_version_range", "name": "vers:unknown/v0.144.0", "product": { "name": "vers:unknown/v0.144.0", "product_id": "CSAFPID-9727426" } }, { "category": "product_version_range", "name": "vers:unknown/v0.145.0", "product": { "name": "vers:unknown/v0.145.0", "product_id": "CSAFPID-9727427" } }, { "category": "product_version_range", "name": "vers:unknown/v0.146.0", "product": { "name": "vers:unknown/v0.146.0", "product_id": "CSAFPID-9727428" } }, { "category": "product_version_range", "name": "vers:unknown/v0.147.0", "product": { "name": "vers:unknown/v0.147.0", "product_id": "CSAFPID-9727429" } }, { "category": "product_version_range", "name": "vers:unknown/v0.15.0", "product": { "name": "vers:unknown/v0.15.0", "product_id": "CSAFPID-3787784" } }, { "category": "product_version_range", "name": "vers:unknown/v0.16.0", "product": { "name": "vers:unknown/v0.16.0", "product_id": "CSAFPID-3787785" } }, { "category": "product_version_range", "name": "vers:unknown/v0.17.0", "product": { "name": "vers:unknown/v0.17.0", "product_id": "CSAFPID-3787786" } }, { "category": "product_version_range", "name": "vers:unknown/v0.18.0", "product": { "name": "vers:unknown/v0.18.0", "product_id": "CSAFPID-3787787" } }, { "category": "product_version_range", "name": "vers:unknown/v0.19.0", "product": { "name": "vers:unknown/v0.19.0", "product_id": "CSAFPID-3787788" } }, { "category": "product_version_range", "name": "vers:unknown/v0.2.0", "product": { "name": "vers:unknown/v0.2.0", "product_id": "CSAFPID-3787789" } }, { "category": "product_version_range", "name": "vers:unknown/v0.20.0", "product": { "name": "vers:unknown/v0.20.0", "product_id": "CSAFPID-3787790" } }, { "category": "product_version_range", "name": "vers:unknown/v0.21.0", "product": { "name": "vers:unknown/v0.21.0", "product_id": "CSAFPID-3787791" } }, { "category": "product_version_range", "name": "vers:unknown/v0.22.0", "product": { "name": "vers:unknown/v0.22.0", "product_id": "CSAFPID-3787792" } }, { "category": "product_version_range", "name": "vers:unknown/v0.22.1", "product": { "name": "vers:unknown/v0.22.1", "product_id": "CSAFPID-3787793" } }, { "category": "product_version_range", "name": "vers:unknown/v0.23.0", "product": { "name": "vers:unknown/v0.23.0", "product_id": "CSAFPID-3787794" } }, { "category": "product_version_range", "name": "vers:unknown/v0.24.0", "product": { "name": "vers:unknown/v0.24.0", "product_id": "CSAFPID-3787795" } }, { "category": "product_version_range", "name": "vers:unknown/v0.25.0", "product": { "name": "vers:unknown/v0.25.0", "product_id": "CSAFPID-3787796" } }, { "category": "product_version_range", "name": "vers:unknown/v0.26.0", "product": { "name": "vers:unknown/v0.26.0", "product_id": "CSAFPID-3787797" } }, { "category": "product_version_range", "name": "vers:unknown/v0.27.0", "product": { "name": "vers:unknown/v0.27.0", "product_id": "CSAFPID-3787798" } }, { "category": "product_version_range", "name": "vers:unknown/v0.28.0", "product": { "name": "vers:unknown/v0.28.0", "product_id": "CSAFPID-3787799" } }, { "category": "product_version_range", "name": "vers:unknown/v0.29.0", "product": { "name": "vers:unknown/v0.29.0", "product_id": "CSAFPID-3787800" } }, { "category": "product_version_range", "name": "vers:unknown/v0.3.0", "product": { "name": "vers:unknown/v0.3.0", "product_id": "CSAFPID-3787801" } }, { "category": "product_version_range", "name": "vers:unknown/v0.3.1", "product": { "name": "vers:unknown/v0.3.1", "product_id": "CSAFPID-3787802" } }, { "category": "product_version_range", "name": "vers:unknown/v0.30.0", "product": { "name": "vers:unknown/v0.30.0", "product_id": "CSAFPID-3787803" } }, { "category": "product_version_range", "name": "vers:unknown/v0.31.0", "product": { "name": "vers:unknown/v0.31.0", "product_id": "CSAFPID-3787804" } }, { "category": "product_version_range", "name": "vers:unknown/v0.32.0", "product": { "name": "vers:unknown/v0.32.0", "product_id": "CSAFPID-3787805" } }, { "category": "product_version_range", "name": "vers:unknown/v0.33.0", "product": { "name": "vers:unknown/v0.33.0", "product_id": "CSAFPID-3787806" } }, { "category": "product_version_range", "name": "vers:unknown/v0.34.0", "product": { "name": "vers:unknown/v0.34.0", "product_id": "CSAFPID-3787807" } }, { "category": "product_version_range", "name": "vers:unknown/v0.35.0", "product": { "name": "vers:unknown/v0.35.0", "product_id": "CSAFPID-3787808" } }, { "category": "product_version_range", "name": "vers:unknown/v0.36.0", "product": { "name": "vers:unknown/v0.36.0", "product_id": "CSAFPID-3787809" } }, { "category": "product_version_range", "name": "vers:unknown/v0.37.0", "product": { "name": "vers:unknown/v0.37.0", "product_id": "CSAFPID-3787810" } }, { "category": "product_version_range", "name": "vers:unknown/v0.38.0", "product": { "name": "vers:unknown/v0.38.0", "product_id": "CSAFPID-3787811" } }, { "category": "product_version_range", "name": "vers:unknown/v0.39.0", "product": { "name": "vers:unknown/v0.39.0", "product_id": "CSAFPID-3787812" } }, { "category": "product_version_range", "name": "vers:unknown/v0.4.0", "product": { "name": "vers:unknown/v0.4.0", "product_id": "CSAFPID-3787813" } }, { "category": "product_version_range", "name": "vers:unknown/v0.40.0", "product": { "name": "vers:unknown/v0.40.0", "product_id": "CSAFPID-3787814" } }, { "category": "product_version_range", "name": "vers:unknown/v0.41.0", "product": { "name": "vers:unknown/v0.41.0", "product_id": "CSAFPID-3787815" } }, { "category": "product_version_range", "name": "vers:unknown/v0.42.0", "product": { "name": "vers:unknown/v0.42.0", "product_id": "CSAFPID-3787816" } }, { "category": "product_version_range", "name": "vers:unknown/v0.43.0", "product": { "name": "vers:unknown/v0.43.0", "product_id": "CSAFPID-3787817" } }, { "category": "product_version_range", "name": "vers:unknown/v0.44.0", "product": { "name": "vers:unknown/v0.44.0", "product_id": "CSAFPID-3787818" } }, { "category": "product_version_range", "name": "vers:unknown/v0.45.0", "product": { "name": "vers:unknown/v0.45.0", "product_id": "CSAFPID-3787819" } }, { "category": "product_version_range", "name": "vers:unknown/v0.45.1", "product": { "name": "vers:unknown/v0.45.1", "product_id": "CSAFPID-3787820" } }, { "category": "product_version_range", "name": "vers:unknown/v0.46.0", "product": { "name": "vers:unknown/v0.46.0", "product_id": "CSAFPID-3787821" } }, { "category": "product_version_range", "name": "vers:unknown/v0.47.0", "product": { "name": "vers:unknown/v0.47.0", "product_id": "CSAFPID-3787822" } }, { "category": "product_version_range", "name": "vers:unknown/v0.48.0", "product": { "name": "vers:unknown/v0.48.0", "product_id": "CSAFPID-3787823" } }, { "category": "product_version_range", "name": "vers:unknown/v0.49.0", "product": { "name": "vers:unknown/v0.49.0", "product_id": "CSAFPID-3787824" } }, { "category": "product_version_range", "name": "vers:unknown/v0.5.0", "product": { "name": "vers:unknown/v0.5.0", "product_id": "CSAFPID-3787825" } }, { "category": "product_version_range", "name": "vers:unknown/v0.5.1", "product": { "name": "vers:unknown/v0.5.1", "product_id": "CSAFPID-3787826" } }, { "category": "product_version_range", "name": "vers:unknown/v0.50.0", "product": { "name": "vers:unknown/v0.50.0", "product_id": "CSAFPID-3787827" } }, { "category": "product_version_range", "name": "vers:unknown/v0.51.0", "product": { "name": "vers:unknown/v0.51.0", "product_id": "CSAFPID-3787828" } }, { "category": "product_version_range", "name": "vers:unknown/v0.52.0", "product": { "name": "vers:unknown/v0.52.0", "product_id": "CSAFPID-3787829" } }, { "category": "product_version_range", "name": "vers:unknown/v0.53.0", "product": { "name": "vers:unknown/v0.53.0", "product_id": "CSAFPID-3787830" } }, { "category": "product_version_range", "name": "vers:unknown/v0.54.0", "product": { "name": "vers:unknown/v0.54.0", "product_id": "CSAFPID-3787831" } }, { "category": "product_version_range", "name": "vers:unknown/v0.55.0", "product": { "name": "vers:unknown/v0.55.0", "product_id": "CSAFPID-3787832" } }, { "category": "product_version_range", "name": "vers:unknown/v0.56.0", "product": { "name": "vers:unknown/v0.56.0", "product_id": "CSAFPID-3787833" } }, { "category": "product_version_range", "name": "vers:unknown/v0.57.0", "product": { "name": "vers:unknown/v0.57.0", "product_id": "CSAFPID-3787834" } }, { "category": "product_version_range", "name": "vers:unknown/v0.58.0", "product": { "name": "vers:unknown/v0.58.0", "product_id": "CSAFPID-3787835" } }, { "category": "product_version_range", "name": "vers:unknown/v0.59.0", "product": { "name": "vers:unknown/v0.59.0", "product_id": "CSAFPID-3787836" } }, { "category": "product_version_range", "name": "vers:unknown/v0.6.0", "product": { "name": "vers:unknown/v0.6.0", "product_id": "CSAFPID-3787837" } }, { "category": "product_version_range", "name": "vers:unknown/v0.60.0", "product": { "name": "vers:unknown/v0.60.0", "product_id": "CSAFPID-3787838" } }, { "category": "product_version_range", "name": "vers:unknown/v0.61.0", "product": { "name": "vers:unknown/v0.61.0", "product_id": "CSAFPID-3787839" } }, { "category": "product_version_range", "name": "vers:unknown/v0.62.0", "product": { "name": "vers:unknown/v0.62.0", "product_id": "CSAFPID-3787840" } }, { "category": "product_version_range", "name": "vers:unknown/v0.63.0", "product": { "name": "vers:unknown/v0.63.0", "product_id": "CSAFPID-3787841" } }, { "category": "product_version_range", "name": "vers:unknown/v0.64.0", "product": { "name": "vers:unknown/v0.64.0", "product_id": "CSAFPID-3787842" } }, { "category": "product_version_range", "name": "vers:unknown/v0.65.0", "product": { "name": "vers:unknown/v0.65.0", "product_id": "CSAFPID-3787843" } }, { "category": "product_version_range", "name": "vers:unknown/v0.66.0", "product": { "name": "vers:unknown/v0.66.0", "product_id": "CSAFPID-3787844" } }, { "category": "product_version_range", "name": "vers:unknown/v0.67.0", "product": { "name": "vers:unknown/v0.67.0", "product_id": "CSAFPID-3787845" } }, { "category": "product_version_range", "name": "vers:unknown/v0.68.0", "product": { "name": "vers:unknown/v0.68.0", "product_id": "CSAFPID-3787846" } }, { "category": "product_version_range", "name": "vers:unknown/v0.69.0", "product": { "name": "vers:unknown/v0.69.0", "product_id": "CSAFPID-3787847" } }, { "category": "product_version_range", "name": "vers:unknown/v0.7.0", "product": { "name": "vers:unknown/v0.7.0", "product_id": "CSAFPID-3787848" } }, { "category": "product_version_range", "name": "vers:unknown/v0.70.0", "product": { "name": "vers:unknown/v0.70.0", "product_id": "CSAFPID-3787849" } }, { "category": "product_version_range", "name": "vers:unknown/v0.71.0", "product": { "name": "vers:unknown/v0.71.0", "product_id": "CSAFPID-3787850" } }, { "category": "product_version_range", "name": "vers:unknown/v0.72.0", "product": { "name": "vers:unknown/v0.72.0", "product_id": "CSAFPID-3787851" } }, { "category": "product_version_range", "name": "vers:unknown/v0.73.0", "product": { "name": "vers:unknown/v0.73.0", "product_id": "CSAFPID-3787852" } }, { "category": "product_version_range", "name": "vers:unknown/v0.74.0", "product": { "name": "vers:unknown/v0.74.0", "product_id": "CSAFPID-3787853" } }, { "category": "product_version_range", "name": "vers:unknown/v0.75.0", "product": { "name": "vers:unknown/v0.75.0", "product_id": "CSAFPID-3787854" } }, { "category": "product_version_range", "name": "vers:unknown/v0.76.0", "product": { "name": "vers:unknown/v0.76.0", "product_id": "CSAFPID-3787855" } }, { "category": "product_version_range", "name": "vers:unknown/v0.77.0", "product": { "name": "vers:unknown/v0.77.0", "product_id": "CSAFPID-3787856" } }, { "category": "product_version_range", "name": "vers:unknown/v0.78.0", "product": { "name": "vers:unknown/v0.78.0", "product_id": "CSAFPID-3787857" } }, { "category": "product_version_range", "name": "vers:unknown/v0.79.0", "product": { "name": "vers:unknown/v0.79.0", "product_id": "CSAFPID-3787858" } }, { "category": "product_version_range", "name": "vers:unknown/v0.8.0", "product": { "name": "vers:unknown/v0.8.0", "product_id": "CSAFPID-3787859" } }, { "category": "product_version_range", "name": "vers:unknown/v0.80.0", "product": { "name": "vers:unknown/v0.80.0", "product_id": "CSAFPID-3787860" } }, { "category": "product_version_range", "name": "vers:unknown/v0.81.0", "product": { "name": "vers:unknown/v0.81.0", "product_id": "CSAFPID-3787861" } }, { "category": "product_version_range", "name": "vers:unknown/v0.82.0", "product": { "name": "vers:unknown/v0.82.0", "product_id": "CSAFPID-3787862" } }, { "category": "product_version_range", "name": "vers:unknown/v0.83.0", "product": { "name": "vers:unknown/v0.83.0", "product_id": "CSAFPID-3787863" } }, { "category": "product_version_range", "name": "vers:unknown/v0.84.0", "product": { "name": "vers:unknown/v0.84.0", "product_id": "CSAFPID-3787864" } }, { "category": "product_version_range", "name": "vers:unknown/v0.85.0", "product": { "name": "vers:unknown/v0.85.0", "product_id": "CSAFPID-3787865" } }, { "category": "product_version_range", "name": "vers:unknown/v0.86.0", "product": { "name": "vers:unknown/v0.86.0", "product_id": "CSAFPID-3787866" } }, { "category": "product_version_range", "name": "vers:unknown/v0.87.0", "product": { "name": "vers:unknown/v0.87.0", "product_id": "CSAFPID-3787867" } }, { "category": "product_version_range", "name": "vers:unknown/v0.88.0", "product": { "name": "vers:unknown/v0.88.0", "product_id": "CSAFPID-3787868" } }, { "category": "product_version_range", "name": "vers:unknown/v0.89.0", "product": { "name": "vers:unknown/v0.89.0", "product_id": "CSAFPID-3787869" } }, { "category": "product_version_range", "name": "vers:unknown/v0.9.0", "product": { "name": "vers:unknown/v0.9.0", "product_id": "CSAFPID-3787870" } }, { "category": "product_version_range", "name": "vers:unknown/v0.90.0", "product": { "name": "vers:unknown/v0.90.0", "product_id": "CSAFPID-3787871" } }, { "category": "product_version_range", "name": "vers:unknown/v0.91.0", "product": { "name": "vers:unknown/v0.91.0", "product_id": "CSAFPID-3787872" } }, { "category": "product_version_range", "name": "vers:unknown/v0.92.0", "product": { "name": "vers:unknown/v0.92.0", "product_id": "CSAFPID-3787873" } }, { "category": "product_version_range", "name": "vers:unknown/v0.93.0", "product": { "name": "vers:unknown/v0.93.0", "product_id": "CSAFPID-3787874" } }, { "category": "product_version_range", "name": "vers:unknown/v0.94.0", "product": { "name": "vers:unknown/v0.94.0", "product_id": "CSAFPID-3787875" } }, { "category": "product_version_range", "name": "vers:unknown/v0.95.0", "product": { "name": "vers:unknown/v0.95.0", "product_id": "CSAFPID-3787876" } }, { "category": "product_version_range", "name": "vers:unknown/v0.96.0", "product": { "name": "vers:unknown/v0.96.0", "product_id": "CSAFPID-3787877" } }, { "category": "product_version_range", "name": "vers:unknown/v0.97.0", "product": { "name": "vers:unknown/v0.97.0", "product_id": "CSAFPID-3787878" } }, { "category": "product_version_range", "name": "vers:unknown/v0.98.0", "product": { "name": "vers:unknown/v0.98.0", "product_id": "CSAFPID-3787879" } }, { "category": "product_version_range", "name": "vers:unknown/v0.99.0", "product": { "name": "vers:unknown/v0.99.0", "product_id": "CSAFPID-3787880" } } ], "category": "product_name", "name": "kin-openapi" } ], "category": "vendor", "name": "getkin" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-100352", "cwe": { "id": "CWE-754", "name": "Improper Check for Unusual or Exceptional Conditions" }, "notes": [ { "category": "description", "text": "A flaw was found in kin-openapi. A remote, unauthenticated attacker can exploit this vulnerability by submitting a specially crafted YAML request containing non-finite numeric values, such as Not-a-Number or infinity, to an endpoint with numeric constraints. Because the validation process fails to restrict these unexpected values, the application triggers a runtime crash. This allows an attacker to cause a Denial of Service (DoS) on the affected service.", "title": "redhat - https://access.redhat.com/errata/RHSA-2026:87077" }, { "category": "description", "text": "kin-openapi is a Go project for handling OpenAPI files. Prior to 0.148.0, the OpenAPI 3.1 validation path passes YAML NaN and infinity numeric values to santhosh-tekuri/jsonschema v6.0.2 without applying kin-openapi's existing finite-number guards. A remote unauthenticated client can send an application/yaml or application/x-yaml request body containing .nan, .inf, or -.inf to an operation with a numeric constraint, causing the dependency to create and dereference a nil big.Rat during ValidateRequest. Standard net/http servers recover the panic per connection, while other hosts or application goroutines may terminate the process. This issue is fixed in version 0.148.0.", "title": "nvd - https://nvd.nist.gov/vuln/detail/CVE-2026-100352" }, { "category": "description", "text": "## Summary\n\nkin-openapi guards against `NaN` and `Inf` values in its built-in schema visitor (`visitJSON`) by returning `ErrSchemaInputNaN` / `ErrSchemaInputInf` when a `float64` input violates those constraints. For OAS 3.1 specs, however, `Schema.VisitJSON` routes through `useJSONSchema2020`, which hands the value directly to `santhosh-tekuri/jsonschema/v6` v6.0.2 without applying the same guard.\n\nInside `jsonschema/v6` v6.0.2, `numValidate` builds a `*big.Rat` from the input via `big.Rat.SetString(fmt.Sprintf(\"%v\", v))`. For `NaN`/`Inf` this parse fails silently and returns `nil`. `numValidate` then dereferences the nil `*big.Rat` (in `math/big.(*Rat).Cmp`), producing a Go runtime panic.\n\nAn attacker delivers this by sending an HTTP request with `Content-Type: application/yaml` (or `application/x-yaml`) and a YAML body containing `.nan`, `.inf`, or `-.inf`. The `YamlBodyDecoder` decodes those tokens into `math.NaN()` / `math.Inf(±1)` (standard YAML 1.2 behavior), and they propagate to the unguarded `useJSONSchema2020` path whenever the schema declares a numeric constraint (`minimum`, `maximum`, `exclusiveMinimum`, `exclusiveMaximum`, or `multipleOf`).\n\n## Details\n### Root Cause\n\nThe built-in visitor `visitJSON` at `openapi3/schema.go:1968` guards NaN/Inf explicitly:\n\n```go\ncase float64:\n if math.IsNaN(value) {\n return ErrSchemaInputNaN\n }\n if math.IsInf(value, 0) {\n return ErrSchemaInputInf\n }\n```\n\nFor OAS 3.1 specs, `VisitJSON` dispatches to `useJSONSchema2020` (`openapi3/schema_jsonschema_validator.go:204`), which contains no such guard:\n\n```go\nfunc (schema *Schema) useJSONSchema2020(settings *schemaValidationSettings, value any) error {\n validator, err := newJSONSchemaValidator(schema)\n if err != nil {\n return schema.visitJSON(settings, value)\n }\n return validator.validate(value) // value handed straight through\n}\n```\n\n`jsonSchemaValidator.validate` calls `jsonschema/v6.Schema.Validate` (line 146), which reaches `numValidate` in v6.0.2. There, `big.Rat.SetString(fmt.Sprintf(\"%v\", v))` returns `(nil, false)` for `NaN`/`Inf`, and the code dereferences the `nil` `*big.Rat` in `Rat.Cmp`, causing the panic.\n\n## Proof of Concept\n\n### Environment\n\n- kin-openapi v0.144.0 (tag `v0.144.0`, commit `f0407d5`)\n- santhosh-tekuri/jsonschema/v6 v6.0.2 (transitive dep)\n- Go 1.26.7\n\n### Spec\n\nMinimal OAS 3.1 spec (`spec.yaml`) declaring a YAML body with a numeric constraint:\n\n```yaml\nopenapi: '3.1.0'\ninfo: { title: Test, version: '1.0' }\npaths:\n /test:\n post:\n requestBody:\n required: true\n content:\n application/yaml:\n schema:\n type: number\n minimum: 0\n responses:\n '200': { description: OK }\n```\n\n### Trigger\n\nA single `POST /test` with `Content-Type: application/yaml` and body `.nan`, `.inf`, or `-.inf`. All three variants panic:\n\n```\n=== RUN TestNaNInf\n[nan] PANIC (confirms vuln): runtime error: invalid memory address or nil pointer dereference\n[inf] PANIC (confirms vuln): runtime error: invalid memory address or nil pointer dereference\n[neginf] PANIC (confirms vuln): runtime error: invalid memory address or nil pointer dereference\n```\n\n### Panic stack trace (confirms exact chain)\n\n```\npanic: runtime error: invalid memory address or nil pointer dereference\n\nmath/big.(*Rat).Cmp(0x0, ...) <- nil *big.Rat dereferenced\n C:/Program Files/Go/src/math/big/rat.go:492\ngithub.com/santhosh-tekuri/jsonschema/v6.(*validator).numValidate(...)\n .../jsonschema/v6@v6.0.2/validator.go:525\ngithub.com/santhosh-tekuri/jsonschema/v6.(*validator).validate(...)\n .../jsonschema/v6@v6.0.2/validator.go:168\ngithub.com/santhosh-tekuri/jsonschema/v6.(*Schema).validate(...)\n .../jsonschema/v6@v6.0.2/validator.go:34\ngithub.com/getkin/kin-openapi/openapi3.(*jsonSchemaValidator).validate(...)\n openapi3/schema_jsonschema_validator.go:146\ngithub.com/getkin/kin-openapi/openapi3.(*Schema).useJSONSchema2020(...) <- MISSING NaN/Inf guard\n openapi3/schema_jsonschema_validator.go:211\ngithub.com/getkin/kin-openapi/openapi3.(*Schema).VisitJSON(...)\n openapi3/schema.go:1946\ngithub.com/getkin/kin-openapi/openapi3filter.ValidateRequestBody(...)\n openapi3filter/validate_request.go:364\ngithub.com/getkin/kin-openapi/openapi3filter.ValidateRequest(...)\n openapi3filter/validate_request.go:96\n```\n\n### net/http behavior (severity nuance)\n\nBehind a standard `net/http` server, the panic is recovered per-connection. The client sees a dropped connection; the server process continues:\n\n```\nSending POST /test body=.nan against real net/http server...\n2026/08/25 http: panic serving 127.0.0.1:40625: runtime error: invalid memory address or nil pointer dereference\nCLIENT ERROR (connection dropped): Post \".../test\": EOF\nProcess still alive after request: true\n```\n\nThis is a **recoverable panic**, unlike the recursion finding. `recover()` catches it (verified by capturing the panic value in a `defer` in the same goroutine). Non-`net/http` hosts or validation performed in an application-spawned goroutine are not covered by that recovery and would experience a full-process crash.\n\n### Fix verification\n\nUpgrading only the transitive dependency to `jsonschema/v6@v6.0.3` (via `go get github.com/santhosh-tekuri/jsonschema/v6@v6.0.3`) eliminates the panic entirely; all three payloads return a clean validation error:\n\n```\n[nan] Returned normally, err = request body has an error: doesn't match schema: validation failed due to: at '': invalid jsonType float64\n[inf] Returned normally, err = request body has an error: doesn't match schema: validation failed due to: at '': invalid jsonType float64\n[neginf] Returned normally, err = request body has an error: doesn't match schema: validation failed due to: at '': invalid jsonType float64\n```\n\nThis confirms the upstream `jsonschema/v6` v6.0.3 release treats the NaN/Inf case as a bug and fixes it at the source. It also confirms `useJSONSchema2020` is the reachable path: patching only the transitive dep removes the panic without touching kin-openapi code.\n\n## Why This Is a Vulnerability, Not by Design\n\n- The library explicitly refuses NaN/Inf in its own visitor (`ErrSchemaInputNaN` / `ErrSchemaInputInf` at `schema.go:1968`). The stated policy is: these values are not allowed.\n- The OAS 3.1 dispatch (`useJSONSchema2020`) simply omits the same guard — a coding gap, not a design decision.\n- Upstream `jsonschema/v6` v6.0.3 fixes the same case as a bug. Two independent code owners agree it should not panic.\n- The trigger is a single HTTP request body an unauthenticated client can send. There is no legitimate content-authoring reason to submit `.nan` / `.inf` as a numeric field.\n\n## Impact\n\n- **Per-request denial of service (net/http hosts).** Every crafted request kills its own connection with zero attacker cost. Sustained flooding degrades service reliability and log noise.\n- **Full-process denial of service (non-net/http hosts or goroutine-spawned validation).** No `net/http` recovery wrapper is present; the whole process crashes on a single request.\n- **Attack surface is any OAS 3.1 API that accepts YAML bodies with numeric constraints.** These constraints (`minimum`, `maximum`, `exclusiveMinimum`, `exclusiveMaximum`, `multipleOf`) are common on any numeric field with a range.", "title": "github - https://github.com/advisories/GHSA-rj39-cv6w-8wv7" }, { "category": "description", "text": "A flaw was found in kin-openapi. A remote, unauthenticated attacker can exploit this vulnerability by submitting a specially crafted YAML request containing non-finite numeric values, such as Not-a-Number or infinity, to an endpoint with numeric constraints. Because the validation process fails to restrict these unexpected values, the application triggers a runtime crash. This allows an attacker to cause a Denial of Service (DoS) on the affected service.", "title": "redhat - https://access.redhat.com/security/cve/CVE-2026-100352" }, { "category": "description", "text": "kin-openapi is a Go project for handling OpenAPI files. Prior to 0.148.0, the OpenAPI 3.1 validation path passes YAML NaN and infinity numeric values to santhosh-tekuri/jsonschema v6.0.2 without applying kin-openapi's existing finite-number guards. A remote unauthenticated client can send an application/yaml or application/x-yaml request body containing .nan, .inf, or -.inf to an operation with a numeric constraint, causing the dependency to create and dereference a nil big.Rat during ValidateRequest. Standard net/http servers recover the panic per connection, while other hosts or application goroutines may terminate the process. This issue is fixed in version 0.148.0.", "title": "debian - https://security-tracker.debian.org/tracker/CVE-2026-100352" }, { "category": "description", "text": "kin-openapi is a Go project for handling OpenAPI files. Prior to 0.148.0, the OpenAPI 3.1 validation path passes YAML NaN and infinity numeric values to santhosh-tekuri/jsonschema v6.0.2 without applying kin-openapi's existing finite-number guards. A remote unauthenticated client can send an application/yaml or application/x-yaml request body containing .nan, .inf, or -.inf to an operation with a numeric constraint, causing the dependency to create and dereference a nil big.Rat during ValidateRequest. Standard net/http servers recover the panic per connection, while other hosts or application goroutines may terminate the process. This issue is fixed in version 0.148.0.", "title": "cveprojectv5 - https://www.cve.org/CVERecord?id=CVE-2026-100352" }, { "category": "description", "text": "kin-openapi is a Go project for handling OpenAPI files. Prior to 0.148.0, the OpenAPI 3.1 validation path passes YAML NaN and infinity numeric values to santhosh-tekuri/jsonschema v6.0.2 without applying kin-openapi's existing finite-number guards. A remote unauthenticated client can send an application/yaml or application/x-yaml request body containing .nan, .inf, or -.inf to an operation with a numeric constraint, causing the dependency to create and dereference a nil big.Rat during ValidateRequest. Standard net/http servers recover the panic per connection, while other hosts or application goroutines may terminate the process. This issue is fixed in version 0.148.0.", "title": "osvgit - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-100352.json?alt=media" }, { "category": "description", "text": "## Summary\n\nkin-openapi guards against `NaN` and `Inf` values in its built-in schema visitor (`visitJSON`) by returning `ErrSchemaInputNaN` / `ErrSchemaInputInf` when a `float64` input violates those constraints. For OAS 3.1 specs, however, `Schema.VisitJSON` routes through `useJSONSchema2020`, which hands the value directly to `santhosh-tekuri/jsonschema/v6` v6.0.2 without applying the same guard.\n\nInside `jsonschema/v6` v6.0.2, `numValidate` builds a `*big.Rat` from the input via `big.Rat.SetString(fmt.Sprintf(\"%v\", v))`. For `NaN`/`Inf` this parse fails silently and returns `nil`. `numValidate` then dereferences the nil `*big.Rat` (in `math/big.(*Rat).Cmp`), producing a Go runtime panic.\n\nAn attacker delivers this by sending an HTTP request with `Content-Type: application/yaml` (or `application/x-yaml`) and a YAML body containing `.nan`, `.inf`, or `-.inf`. The `YamlBodyDecoder` decodes those tokens into `math.NaN()` / `math.Inf(±1)` (standard YAML 1.2 behavior), and they propagate to the unguarded `useJSONSchema2020` path whenever the schema declares a numeric constraint (`minimum`, `maximum`, `exclusiveMinimum`, `exclusiveMaximum`, or `multipleOf`).\n\n## Details\n### Root Cause\n\nThe built-in visitor `visitJSON` at `openapi3/schema.go:1968` guards NaN/Inf explicitly:\n\n```go\ncase float64:\n if math.IsNaN(value) {\n return ErrSchemaInputNaN\n }\n if math.IsInf(value, 0) {\n return ErrSchemaInputInf\n }\n```\n\nFor OAS 3.1 specs, `VisitJSON` dispatches to `useJSONSchema2020` (`openapi3/schema_jsonschema_validator.go:204`), which contains no such guard:\n\n```go\nfunc (schema *Schema) useJSONSchema2020(settings *schemaValidationSettings, value any) error {\n validator, err := newJSONSchemaValidator(schema)\n if err != nil {\n return schema.visitJSON(settings, value)\n }\n return validator.validate(value) // value handed straight through\n}\n```\n\n`jsonSchemaValidator.validate` calls `jsonschema/v6.Schema.Validate` (line 146), which reaches `numValidate` in v6.0.2. There, `big.Rat.SetString(fmt.Sprintf(\"%v\", v))` returns `(nil, false)` for `NaN`/`Inf`, and the code dereferences the `nil` `*big.Rat` in `Rat.Cmp`, causing the panic.\n\n## Proof of Concept\n\n### Environment\n\n- kin-openapi v0.144.0 (tag `v0.144.0`, commit `f0407d5`)\n- santhosh-tekuri/jsonschema/v6 v6.0.2 (transitive dep)\n- Go 1.26.7\n\n### Spec\n\nMinimal OAS 3.1 spec (`spec.yaml`) declaring a YAML body with a numeric constraint:\n\n```yaml\nopenapi: '3.1.0'\ninfo: { title: Test, version: '1.0' }\npaths:\n /test:\n post:\n requestBody:\n required: true\n content:\n application/yaml:\n schema:\n type: number\n minimum: 0\n responses:\n '200': { description: OK }\n```\n\n### Trigger\n\nA single `POST /test` with `Content-Type: application/yaml` and body `.nan`, `.inf`, or `-.inf`. All three variants panic:\n\n```\n=== RUN TestNaNInf\n[nan] PANIC (confirms vuln): runtime error: invalid memory address or nil pointer dereference\n[inf] PANIC (confirms vuln): runtime error: invalid memory address or nil pointer dereference\n[neginf] PANIC (confirms vuln): runtime error: invalid memory address or nil pointer dereference\n```\n\n### Panic stack trace (confirms exact chain)\n\n```\npanic: runtime error: invalid memory address or nil pointer dereference\n\nmath/big.(*Rat).Cmp(0x0, ...) <- nil *big.Rat dereferenced\n C:/Program Files/Go/src/math/big/rat.go:492\ngithub.com/santhosh-tekuri/jsonschema/v6.(*validator).numValidate(...)\n .../jsonschema/v6@v6.0.2/validator.go:525\ngithub.com/santhosh-tekuri/jsonschema/v6.(*validator).validate(...)\n .../jsonschema/v6@v6.0.2/validator.go:168\ngithub.com/santhosh-tekuri/jsonschema/v6.(*Schema).validate(...)\n .../jsonschema/v6@v6.0.2/validator.go:34\ngithub.com/getkin/kin-openapi/openapi3.(*jsonSchemaValidator).validate(...)\n openapi3/schema_jsonschema_validator.go:146\ngithub.com/getkin/kin-openapi/openapi3.(*Schema).useJSONSchema2020(...) <- MISSING NaN/Inf guard\n openapi3/schema_jsonschema_validator.go:211\ngithub.com/getkin/kin-openapi/openapi3.(*Schema).VisitJSON(...)\n openapi3/schema.go:1946\ngithub.com/getkin/kin-openapi/openapi3filter.ValidateRequestBody(...)\n openapi3filter/validate_request.go:364\ngithub.com/getkin/kin-openapi/openapi3filter.ValidateRequest(...)\n openapi3filter/validate_request.go:96\n```\n\n### net/http behavior (severity nuance)\n\nBehind a standard `net/http` server, the panic is recovered per-connection. The client sees a dropped connection; the server process continues:\n\n```\nSending POST /test body=.nan against real net/http server...\n2026/08/25 http: panic serving 127.0.0.1:40625: runtime error: invalid memory address or nil pointer dereference\nCLIENT ERROR (connection dropped): Post \".../test\": EOF\nProcess still alive after request: true\n```\n\nThis is a **recoverable panic**, unlike the recursion finding. `recover()` catches it (verified by capturing the panic value in a `defer` in the same goroutine). Non-`net/http` hosts or validation performed in an application-spawned goroutine are not covered by that recovery and would experience a full-process crash.\n\n### Fix verification\n\nUpgrading only the transitive dependency to `jsonschema/v6@v6.0.3` (via `go get github.com/santhosh-tekuri/jsonschema/v6@v6.0.3`) eliminates the panic entirely; all three payloads return a clean validation error:\n\n```\n[nan] Returned normally, err = request body has an error: doesn't match schema: validation failed due to: at '': invalid jsonType float64\n[inf] Returned normally, err = request body has an error: doesn't match schema: validation failed due to: at '': invalid jsonType float64\n[neginf] Returned normally, err = request body has an error: doesn't match schema: validation failed due to: at '': invalid jsonType float64\n```\n\nThis confirms the upstream `jsonschema/v6` v6.0.3 release treats the NaN/Inf case as a bug and fixes it at the source. It also confirms `useJSONSchema2020` is the reachable path: patching only the transitive dep removes the panic without touching kin-openapi code.\n\n## Why This Is a Vulnerability, Not by Design\n\n- The library explicitly refuses NaN/Inf in its own visitor (`ErrSchemaInputNaN` / `ErrSchemaInputInf` at `schema.go:1968`). The stated policy is: these values are not allowed.\n- The OAS 3.1 dispatch (`useJSONSchema2020`) simply omits the same guard — a coding gap, not a design decision.\n- Upstream `jsonschema/v6` v6.0.3 fixes the same case as a bug. Two independent code owners agree it should not panic.\n- The trigger is a single HTTP request body an unauthenticated client can send. There is no legitimate content-authoring reason to submit `.nan` / `.inf` as a numeric field.\n\n## Impact\n\n- **Per-request denial of service (net/http hosts).** Every crafted request kills its own connection with zero attacker cost. Sustained flooding degrades service reliability and log noise.\n- **Full-process denial of service (non-net/http hosts or goroutine-spawned validation).** No `net/http` recovery wrapper is present; the whole process crashes on a single request.\n- **Attack surface is any OAS 3.1 API that accepts YAML bodies with numeric constraints.** These constraints (`minimum`, `maximum`, `exclusiveMinimum`, `exclusiveMaximum`, `multipleOf`) are common on any numeric field with a range.", "title": "osvgo - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/Go%2FGHSA-rj39-cv6w-8wv7.json?alt=media" }, { "category": "description", "text": "A flaw was found in kin-openapi. A remote, unauthenticated attacker can exploit this vulnerability by submitting a specially crafted YAML request containing non-finite numeric values, such as Not-a-Number or infinity, to an endpoint with numeric constraints. Because the validation process fails to restrict these unexpected values, the application triggers a runtime crash. This allows an attacker to cause a Denial of Service (DoS) on the affected service.", "title": "redhat - https://access.redhat.com/errata/RHSA-2026:85266" }, { "category": "other", "text": "0.00595", "title": "EPSS" }, { "category": "other", "text": "4.4", "title": "NCSC Score" }, { "category": "other", "text": "Is related to CWE-476 (NULL Pointer Dereference), VENDOR FIX as product remediation category", "title": "NCSC Score top increasing factors" }, { "category": "other", "text": "There is product_remediation data available from source Redhat, There is product data available from source Debian", "title": "NCSC Score top decreasing factors" }, { "category": "details", "text": "Severity: 3\n", "title": "Vendor assessment" } ], "product_status": { "fixed": [ "CSAFPID-9764774", "CSAFPID-9821941" ], "known_affected": [ "CSAFPID-6014972", "CSAFPID-8902830", "CSAFPID-8902831", "CSAFPID-9053231", "CSAFPID-9053232", "CSAFPID-9710183", "CSAFPID-9734950", "CSAFPID-3787747", "CSAFPID-3787748", "CSAFPID-3787749", "CSAFPID-3787750", "CSAFPID-3787751", "CSAFPID-3787752", "CSAFPID-3787753", "CSAFPID-3787754", "CSAFPID-3787755", "CSAFPID-3787756", "CSAFPID-3787757", "CSAFPID-3787758", "CSAFPID-3787759", "CSAFPID-3787760", "CSAFPID-3787761", "CSAFPID-3787762", "CSAFPID-3787763", "CSAFPID-3787764", "CSAFPID-3787765", "CSAFPID-3787766", "CSAFPID-3787767", "CSAFPID-3787768", "CSAFPID-3787769", "CSAFPID-3787770", "CSAFPID-3787771", "CSAFPID-3787772", "CSAFPID-3787773", "CSAFPID-3787774", "CSAFPID-3787775", "CSAFPID-3787776", "CSAFPID-3787777", "CSAFPID-3787778", "CSAFPID-3787779", "CSAFPID-3787780", "CSAFPID-3787781", "CSAFPID-3787782", "CSAFPID-8978171", "CSAFPID-8978170", "CSAFPID-8978169", "CSAFPID-8978168", "CSAFPID-8978167", "CSAFPID-8978166", "CSAFPID-8978165", "CSAFPID-8978164", "CSAFPID-8978163", "CSAFPID-3787783", "CSAFPID-8978162", "CSAFPID-8978161", "CSAFPID-8978160", "CSAFPID-8978159", "CSAFPID-9727426", "CSAFPID-9727427", "CSAFPID-9727428", "CSAFPID-9727429", "CSAFPID-3787784", "CSAFPID-3787785", "CSAFPID-3787786", "CSAFPID-3787787", "CSAFPID-3787788", "CSAFPID-3787789", "CSAFPID-3787790", "CSAFPID-3787791", "CSAFPID-3787792", "CSAFPID-3787793", "CSAFPID-3787794", "CSAFPID-3787795", "CSAFPID-3787796", "CSAFPID-3787797", "CSAFPID-3787798", "CSAFPID-3787799", "CSAFPID-3787800", "CSAFPID-3787801", "CSAFPID-3787802", "CSAFPID-3787803", "CSAFPID-3787804", "CSAFPID-3787805", "CSAFPID-3787806", "CSAFPID-3787807", "CSAFPID-3787808", "CSAFPID-3787809", "CSAFPID-3787810", "CSAFPID-3787811", "CSAFPID-3787812", "CSAFPID-3787813", "CSAFPID-3787814", "CSAFPID-3787815", "CSAFPID-3787816", "CSAFPID-3787817", "CSAFPID-3787818", "CSAFPID-3787819", "CSAFPID-3787820", "CSAFPID-3787821", "CSAFPID-3787822", "CSAFPID-3787823", "CSAFPID-3787824", "CSAFPID-3787825", "CSAFPID-3787826", "CSAFPID-3787827", "CSAFPID-3787828", "CSAFPID-3787829", "CSAFPID-3787830", "CSAFPID-3787831", "CSAFPID-3787832", "CSAFPID-3787833", "CSAFPID-3787834", "CSAFPID-3787835", "CSAFPID-3787836", "CSAFPID-3787837", "CSAFPID-3787838", "CSAFPID-3787839", "CSAFPID-3787840", "CSAFPID-3787841", "CSAFPID-3787842", "CSAFPID-3787843", "CSAFPID-3787844", "CSAFPID-3787845", "CSAFPID-3787846", "CSAFPID-3787847", "CSAFPID-3787848", "CSAFPID-3787849", "CSAFPID-3787850", "CSAFPID-3787851", "CSAFPID-3787852", "CSAFPID-3787853", "CSAFPID-3787854", "CSAFPID-3787855", "CSAFPID-3787856", "CSAFPID-3787857", "CSAFPID-3787858", "CSAFPID-3787859", "CSAFPID-3787860", "CSAFPID-3787861", "CSAFPID-3787862", "CSAFPID-3787863", "CSAFPID-3787864", "CSAFPID-3787865", "CSAFPID-3787866", "CSAFPID-3787867", "CSAFPID-3787868", "CSAFPID-3787869", "CSAFPID-3787870", "CSAFPID-3787871", "CSAFPID-3787872", "CSAFPID-3787873", "CSAFPID-3787874", "CSAFPID-3787875", "CSAFPID-3787876", "CSAFPID-3787877", "CSAFPID-3787878", "CSAFPID-3787879", "CSAFPID-3787880", "CSAFPID-9743000", "CSAFPID-8980229" ] }, "references": [ { "category": "external", "summary": "Source - ncscclear", "url": "https://vulnerabilities.ncsc.nl/manual/CVE-2026-100352" }, { "category": "external", "summary": "Source - nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100352" }, { "category": "external", "summary": "Source - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-100352" }, { "category": "external", "summary": "Source - github", "url": "https://github.com/advisories/GHSA-rj39-cv6w-8wv7" }, { "category": "external", "summary": "Source - debian", "url": "https://security-tracker.debian.org/tracker/CVE-2026-100352" }, { "category": "external", "summary": "Source - cveprojectv5", "url": "https://www.cve.org/CVERecord?id=CVE-2026-100352" }, { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-100352.json?alt=media" }, { "category": "external", "summary": "Source - first", "url": "https://api.first.org/data/v1/epss" }, { "category": "external", "summary": "Source - osvgo", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/Go%2FGHSA-rj39-cv6w-8wv7.json?alt=media" }, { "category": "external", "summary": "Source - redhat", "url": "https://access.redhat.com/errata/RHSA-2026:85266" }, { "category": "external", "summary": "Source - redhat", "url": "https://access.redhat.com/errata/RHSA-2026:87077" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-100352" }, { "category": "external", "summary": "Reference - redhat", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553588" }, { "category": "external", "summary": "Reference - redhat", "url": "https://www.cve.org/CVERecord?id=CVE-2026-100352" }, { "category": "external", "summary": "Reference - github; osv; osvgo; redhat", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100352" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv; osvgo; redhat", "url": "https://github.com/getkin/kin-openapi/commit/4487f198ab8be0c37d6ca72c54f5dca4dc25270e" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv; osvgo; redhat", "url": "https://github.com/getkin/kin-openapi/releases/tag/v0.148.0" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv; osvgo; redhat", "url": "https://github.com/getkin/kin-openapi/security/advisories/GHSA-rj39-cv6w-8wv7" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/errata/RHSA-2026:87077" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-100347" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-100348" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-100349" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-100351" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-100353" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-100354" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-110816" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-15577" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-33374" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-93294" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-95502" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/updates/classification/" }, { "category": "external", "summary": "Reference - redhat", "url": "https://images.redhat.com/" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-92539" }, { "category": "external", "summary": "Reference - redhat", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_87077.json" }, { "category": "external", "summary": "Reference - osv", "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-100352.json" }, { "category": "external", "summary": "Reference - github", "url": "https://github.com/advisories/GHSA-rj39-cv6w-8wv7" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/errata/RHSA-2026:85266" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-93450" }, { "category": "external", "summary": "Reference - redhat", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_85266.json" } ], "remediations": [ { "category": "vendor_fix", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "product_ids": [ "CSAFPID-9764774" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:85266" }, { "category": "vendor_fix", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "product_ids": [ "CSAFPID-9821941" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:87077" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-3787747", "CSAFPID-3787748", "CSAFPID-3787749", "CSAFPID-3787750", "CSAFPID-3787751", "CSAFPID-3787752", "CSAFPID-3787753", "CSAFPID-3787754", "CSAFPID-3787755", "CSAFPID-3787756", "CSAFPID-3787757", "CSAFPID-3787758", "CSAFPID-3787759", "CSAFPID-3787760", "CSAFPID-3787761", "CSAFPID-3787762", "CSAFPID-3787763", "CSAFPID-3787764", "CSAFPID-3787765", "CSAFPID-3787766", "CSAFPID-3787767", "CSAFPID-3787768", "CSAFPID-3787769", "CSAFPID-3787770", "CSAFPID-3787771", "CSAFPID-3787772", "CSAFPID-3787773", "CSAFPID-3787774", "CSAFPID-3787775", "CSAFPID-3787776", "CSAFPID-3787777", "CSAFPID-3787778", "CSAFPID-3787779", "CSAFPID-3787780", "CSAFPID-3787781", "CSAFPID-3787782", "CSAFPID-3787783", "CSAFPID-3787784", "CSAFPID-3787785", "CSAFPID-3787786", "CSAFPID-3787787", "CSAFPID-3787788", "CSAFPID-3787789", "CSAFPID-3787790", "CSAFPID-3787791", "CSAFPID-3787792", "CSAFPID-3787793", "CSAFPID-3787794", "CSAFPID-3787795", "CSAFPID-3787796", "CSAFPID-3787797", "CSAFPID-3787798", "CSAFPID-3787799", "CSAFPID-3787800", "CSAFPID-3787801", "CSAFPID-3787802", "CSAFPID-3787803", "CSAFPID-3787804", "CSAFPID-3787805", "CSAFPID-3787806", "CSAFPID-3787807", "CSAFPID-3787808", "CSAFPID-3787809", "CSAFPID-3787810", "CSAFPID-3787811", "CSAFPID-3787812", "CSAFPID-3787813", "CSAFPID-3787814", "CSAFPID-3787815", "CSAFPID-3787816", "CSAFPID-3787817", "CSAFPID-3787818", "CSAFPID-3787819", "CSAFPID-3787820", "CSAFPID-3787821", "CSAFPID-3787822", "CSAFPID-3787823", "CSAFPID-3787824", "CSAFPID-3787825", "CSAFPID-3787826", "CSAFPID-3787827", "CSAFPID-3787828", "CSAFPID-3787829", "CSAFPID-3787830", "CSAFPID-3787831", "CSAFPID-3787832", "CSAFPID-3787833", "CSAFPID-3787834", "CSAFPID-3787835", "CSAFPID-3787836", "CSAFPID-3787837", "CSAFPID-3787838", "CSAFPID-3787839", "CSAFPID-3787840", "CSAFPID-3787841", "CSAFPID-3787842", "CSAFPID-3787843", "CSAFPID-3787844", "CSAFPID-3787845", "CSAFPID-3787846", "CSAFPID-3787847", "CSAFPID-3787848", "CSAFPID-3787849", "CSAFPID-3787850", "CSAFPID-3787851", "CSAFPID-3787852", "CSAFPID-3787853", "CSAFPID-3787854", "CSAFPID-3787855", "CSAFPID-3787856", "CSAFPID-3787857", "CSAFPID-3787858", "CSAFPID-3787859", "CSAFPID-3787860", "CSAFPID-3787861", "CSAFPID-3787862", "CSAFPID-3787863", "CSAFPID-3787864", "CSAFPID-3787865", "CSAFPID-3787866", "CSAFPID-3787867", "CSAFPID-3787868", "CSAFPID-3787869", "CSAFPID-3787870", "CSAFPID-3787871", "CSAFPID-3787872", "CSAFPID-3787873", "CSAFPID-3787874", "CSAFPID-3787875", "CSAFPID-3787876", "CSAFPID-3787877", "CSAFPID-3787878", "CSAFPID-3787879", "CSAFPID-3787880", "CSAFPID-6014972", "CSAFPID-8902830", "CSAFPID-8902831", "CSAFPID-8978159", "CSAFPID-8978160", "CSAFPID-8978161", "CSAFPID-8978162", "CSAFPID-8978163", "CSAFPID-8978164", "CSAFPID-8978165", "CSAFPID-8978166", "CSAFPID-8978167", "CSAFPID-8978168", "CSAFPID-8978169", "CSAFPID-8978170", "CSAFPID-8978171", "CSAFPID-8980229", "CSAFPID-9053231", "CSAFPID-9053232", "CSAFPID-9710183", "CSAFPID-9727426", "CSAFPID-9727427", "CSAFPID-9727428", "CSAFPID-9727429", "CSAFPID-9734950", "CSAFPID-9743000" ] } ], "title": "CVE-2026-100352" } ] }