CVE-2026-100350 kin-openapi deepObject query decoding repeatedly compiles an invariant regular expression

kin-openapi is a Go project for handling OpenAPI files. From 0.145.0 until 0.146.0, openapi3filter repeatedly calls regexp.MustCompile for the same parameter-name regular expression inside the per-query-key loop in urlValuesDecoder.DecodeObject used to decode a deepObject query parameter. An...

CVE-2026-100350

The kin-openapi Go project (versions 0.145.0 through 0.146.0 ) is vulnerable to uncontrolled resource consumption due to an efficiency issue in the urlValuesDecoder.DecodeObject function. Specifically, the openapi3filter repeatedly calls regexp.MustCompile for the same fixed parameter-name regula...