Start for Free
go

github.com/getkin/kin-openapi

View on go registry
28 Total advisories
28 Vulnerabilities
0 Malware

Dependency scanning

Check whether github.com/getkin/kin-openapi is in your codebase

Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.

Explore dependency scanning Explore AI SAST →

Vulnerabilities

HIGH 7.5
Go

CVE-2026-100354

kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crash
MEDIUM 5.3
Go

CVE-2026-100348

kin-openapi spec loader panics on a self-referential additionalProperties $ref (nil-pointer DoS)
HIGH 7.4
Go

CVE-2026-100351

kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion
MEDIUM 5.3
Go

CVE-2026-100350

kin-openapi deepObject query decoding repeatedly compiles an invariant regular expression
MEDIUM 5.3
Go

CVE-2026-100347

kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static path
HIGH 7.5
Go

CVE-2026-100352

kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path
HIGH 7.5
Go

CVE-2026-97394

kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing items
UNKNOWN
Go

CVE-2026-100349

kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content
HIGH 7.5
Go

CVE-2026-100353

kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter
UNKNOWN
Go

CVE-2026-100350

kin-openapi deepObject query decoding repeatedly compiles an invariant regular expression in github.com/getkin/kin-openapi
UNKNOWN
Go

CVE-2026-100353

kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter in github.com/getkin/kin-openapi
UNKNOWN
Go

CVE-2026-100352

kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path in github.com/getkin/kin-openapi
UNKNOWN
Go

CVE-2026-100349

kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content in github.com/getkin/kin-openapi
UNKNOWN
Go

CVE-2026-97394

kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing items in github.com/getkin/kin-openapi
UNKNOWN
Go

CVE-2026-100348

kin-openapi spec loader panics on a self-referential additionalProperties $ref (nil-pointer DoS) in github.com/getkin/kin-openapi
UNKNOWN
Go

CVE-2026-100347

kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static path in github.com/getkin/kin-openapi
UNKNOWN
Go

CVE-2026-100354

kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crash in github.com/getkin/kin-openapi
UNKNOWN
Go

CVE-2026-100351

kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion in github.com/getkin/kin-openapi
UNKNOWN
Go

CVE-2026-77354

kin-openapi has uncontrolled resource consumption in openapi3filter deepObject query parameter decoding
HIGH 7.5
Go

CVE-2026-76905

kin-openapi openai3filter: nil-pointer panic in ConvertErrors on malformed multipart/form-data body enables unauthenticated DoS
CRITICAL 9.1
Go

CVE-2026-73501

kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default
HIGH 7.5
Go

CVE-2025-30153

Improper Handling of Highly Compressed Data (Data Amplification) in github.com/getkin/kin-openapi/openapi3filter
MEDIUM 5.3
Go

CVE-2026-73502

kin-openapi openapi3filter: unauthenticated nil-pointer panic when validating a request against a `content` parameter whose media type has no schema
UNKNOWN
Go

CVE-2026-73501

Authentication bypass via default NoopAuthenticationFunc in github.com/getkin/kin-openapi
UNKNOWN
Go

CVE-2026-73502

Nil-pointer panic on content parameter without schema in github.com/getkin/kin-openapi
UNKNOWN
Go

CVE-2026-77354

kin-openapi has uncontrolled resource consumption in openapi3filter deepObject query parameter decoding in github.com/getkin/kin-openapi
UNKNOWN
Go

CVE-2026-76905

kin-openapi openai3filter: nil-pointer panic in ConvertErrors on malformed multipart/form-data body enables unauthenticated DoS in github.com/getkin/kin-openapi
UNKNOWN
Go

CVE-2025-30153

Improper Handling of Highly Compressed Data (Data Amplification) in github.com/getkin/kin-openapi/openapi3filter

Browse more Go advisories

Learn What is SAST?

Static Application Security Testing finds vulnerabilities like this one in source code before it ships. Read the guide →

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes