kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crash

Summary kin-openapi's spec loader and spec-time validator both handle circular schema references safely: the loader resolves circular $refs on purpose to support recursive data structures, and Schema.validate uses stack-based cycle detection. Validate therefore accepts a schema whose allOf / anyO...

CVE-2026-100354

The kin-openapi Go project (prior to version 0.149.0 ) is vulnerable to a fatal process crash due to uncontrolled recursion. The root cause is a lack of cycle detection during runtime request, response, and direct schema validation when allOf, anyOf, or oneOf chains refer back to an ancestor sche...

CVE-2026-100354 kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crash

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.149.0, runtime request, response, and direct schema validation lacks cycle detection when an allOf, anyOf, or oneOf chain refers back to an ancestor schema, even though loading and document validation accept the circular reference...