getkin kin-openapi
14 vulnérabilités publiées citent ce produit.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-100353 | >= 0.136.0, < 0.149.0 | kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter | HIGH 7.5 | 0.3 % | ||
| CVE-2026-100354 | < 0.149.0 | kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crash | HIGH 7.5 | 0.4 % | ||
| CVE-2026-100352 | < 0.148.0 | kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path | HIGH 7.5 | 0.6 % | ||
| CVE-2026-100351 | >= 0.144.0, < 0.147.0 | kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion | HIGH 7.4 | 0.5 % | ||
| CVE-2026-100349 | < 0.146.0 | kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content | HIGH 8.2 | 0.5 % | ||
| CVE-2026-100350 | >= 0.145.0, < 0.146.0 | kin-openapi deepObject query decoding repeatedly compiles an invariant regular expression | MEDIUM 5.3 | 0.5 % | ||
| CVE-2026-100347 | < 0.145.0 | kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static path | MEDIUM 5.3 | 0.5 % | ||
| CVE-2026-100348 | < 0.145.0 | kin-openapi spec loader panics on a self-referential additionalProperties $ref (nil-pointer DoS) | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-97394 | >= 0.136.0, < 0.143.0 | kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing items | HIGH 7.5 | 0.6 % | ||
| CVE-2026-77354 | >= 0.124.0, < 0.142.0 | kin-openapi: Uncontrolled resource consumption in openapi3filter deepObject query parameter decoding | HIGH 8.7 | 0.5 % | ||
| CVE-2026-76905 | >= 0.10.0, < 0.141.0 | kin-openapi openai3filter: nil-pointer panic in ConvertErrors on malformed multipart/form-data body enables unauthenticated DoS | HIGH 7.5 | 0.6 % | ||
| CVE-2026-73502 | >= 0.2.0, < 0.144.0 | kin-openapi openapi3filter: unauthenticated nil-pointer panic when validating a request against a `content` parameter whose media type ha… | MEDIUM 5.3 | 0.5 % | ||
| CVE-2026-73501 | < 0.144.0 | kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default | CRITICAL 9.1 | 0.4 % | ||
| CVE-2025-30153 | < 0.131.0 | Improper Handling of Highly Compressed Data (Data Amplification) in github.com/getkin/kin-openapi/openapi3filter | HIGH 7.5 | 0.6 % |