CVE-2026-100348 kin-openapi spec loader panics on a self-referential additionalProperties $ref (nil-pointer DoS)

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3.Loader can dereference a nil SchemaRef.Value while resolving a self-referential additionalProperties JSON Reference such as a schema that points to its own additionalProperties member. Loading an attacker-controlle...

CVE-2026-100348

The kin-openapi Go project (prior to version 0.145.0 ) is vulnerable to a nil-pointer dereference leading to a Denial of Service (DoS) . The issue occurs when the openapi3.Loader processes an attacker-controlled OpenAPI document containing a self-referential additionalProperties JSON Reference. S...

GHSA-425G-FJHQ-5H92 openssl-encrypt silently skips schema validation when jsonschema library is not installed

Summary In opensslencrypt/modules/jsonvalidator.py at lines 234-238, when the jsonschema library is not installed, all schema validation is silently skipped with only a print warning. Affected Code python if not JSONSCHEMAAVAILABLE: printf"Warning: Cannot validate against schema 'schemaname' -...