SUSE CVE-2026-100348

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3.Loader can dereference a nil SchemaRef.Value while resolving a self-referential additionalProperties JSON Reference such as a schema that points to its own additionalProperties member. Loading an attacker-controlle...

Linux Distros Unpatched Vulnerability : CVE-2026-100348

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3.Loader can dereference a nil SchemaRef.Value while resolving a self-referenti...

UBUNTU-CVE-2026-100348

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3.Loader can dereference a nil SchemaRef.Value while resolving a self-referential additionalProperties JSON Reference such as a schema that points to its own additionalProperties member. Loading an attacker-controlle...

kin-openapi spec loader panics on a self-referential additionalProperties $ref (nil-pointer DoS)

The defect ---------- Confirmed at HEAD f0407d5, v0.144.0. openapi3/loader.go, inside resolveComponent's drill closure around line 455, the case SchemaRef branch for pathPart == "additionalProperties" dereferences c.Value.AdditionalProperties with no nil-check on c.Value: case SchemaRef: if...

GHSA-MH7X-F8WQ-4JHX kin-openapi spec loader panics on a self-referential additionalProperties $ref (nil-pointer DoS)

The defect ---------- Confirmed at HEAD f0407d5, v0.144.0. openapi3/loader.go, inside resolveComponent's drill closure around line 455, the case SchemaRef branch for pathPart == "additionalProperties" dereferences c.Value.AdditionalProperties with no nil-check on c.Value: case SchemaRef: if...

CVE-2026-100348

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3.Loader can dereference a nil SchemaRef.Value while resolving a self-referential additionalProperties JSON Reference such as a schema that points to its own additionalProperties member. Loading an attacker-controlle...

CVE-2026-100348

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3.Loader can dereference a nil SchemaRef.Value while resolving a self-referential additionalProperties JSON Reference such as a schema that points to its own additionalProperties member. Loading an attacker-controlle...

CVE-2026-100348

The kin-openapi Go project (prior to version 0.145.0 ) is vulnerable to a nil-pointer dereference leading to a Denial of Service (DoS) . The issue occurs when the openapi3.Loader processes an attacker-controlled OpenAPI document containing a self-referential additionalProperties JSON Reference. S...

CVE-2026-100348

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3.Loader can dereference a nil SchemaRef.Value while resolving a self-referential additionalProperties JSON Reference such as a schema that points to its own additionalProperties member. Loading an attacker-controlle...

CVE-2026-100348 kin-openapi spec loader panics on a self-referential additionalProperties $ref (nil-pointer DoS)

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3.Loader can dereference a nil SchemaRef.Value while resolving a self-referential additionalProperties JSON Reference such as a schema that points to its own additionalProperties member. Loading an attacker-controlle...

CVE-2026-100348 kin-openapi spec loader panics on a self-referential additionalProperties $ref (nil-pointer DoS)

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3.Loader can dereference a nil SchemaRef.Value while resolving a self-referential additionalProperties JSON Reference such as a schema that points to its own additionalProperties member. Loading an attacker-controlle...

CVE-2026-100348 kin-openapi spec loader panics on a self-referential additionalProperties $ref (nil-pointer DoS)

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3.Loader can dereference a nil SchemaRef.Value while resolving a self-referential additionalProperties JSON Reference such as a schema that points to its own additionalProperties member. Loading an attacker-controlle...

PT-2026-114979

Name of the Vulnerable Software and Affected Versions kin-openapi versions prior to 0.145.0 Description Loading an attacker-controlled OpenAPI document through LoadFromData, LoadFromFile, or LoadFromURI can cause the loading process to panic. This occurs because the openapi3.Loader can dereferenc...

GHSA-425G-FJHQ-5H92 openssl-encrypt silently skips schema validation when jsonschema library is not installed

Summary In opensslencrypt/modules/jsonvalidator.py at lines 234-238, when the jsonschema library is not installed, all schema validation is silently skipped with only a print warning. Affected Code python if not JSONSCHEMAAVAILABLE: printf"Warning: Cannot validate against schema 'schemaname' -...