{"schema":"threatline.record/2","record":{"id":"CVE-2026-100348","aliases":["GHSA-mh7x-f8wq-4jhx"],"summary":"kin-openapi spec loader panics on a self-referential additionalProperties $ref (nil-pointer DoS)","details":"The defect\n----------\nConfirmed at HEAD (f0407d5, v0.144.0). openapi3/loader.go, inside resolveComponent's drill closure (around line 455), the case *SchemaRef branch for pathPart == \"additionalProperties\" dereferences c.Value.AdditionalProperties with no nil-check on c.Value:\n\n    case *SchemaRef:\n        if pathPart == \"additionalProperties\" {\n            if ap := c.Value.AdditionalProperties.Has; ap != nil {   // c.Value can be nil here\n                cursor = *ap\n            } else {\n                cursor = c.Value.AdditionalProperties.Schema\n            }\n            attempted = true\n        }\n\nWhen a $ref fragment drills through .../additionalProperties of a schema whose Value is still nil (a pure, not-yet-resolved $ref, or a self-reference resolved before its own Value is set), c.Value is nil and the .AdditionalProperties access panics.\n\nInput and attacker\n-------------------\nA tiny crafted OpenAPI document, one schema, no external refs, no network:\n\n    openapi: 3.0.3\n    info: {title: t, version: \"1.0.0\"}\n    paths: {}\n    components:\n      schemas:\n        A:\n          $ref: '#/components/schemas/A/additionalProperties'\n\nAttacker model: any service or tool that loads an untrusted spec via the default openapi3.Loader (LoadFromData / LoadFromFile / LoadFromURI), e.g. a spec registry, an API-management platform ingesting user specs, a linter, or a converter. It crashes during LOAD (ResolveRefsIn), before Validate.\n\nVerification level\n------------------\nEXECUTED with negative controls (agent-run go test at HEAD f0407d5, including yesterday's security merge; the bug is still present). The full stack pins LoadFromData:196 -> ResolveRefsIn:274 -> resolveSchemaRef:1048 -> resolveComponent:485 -> drill:439 -> :455, propagating to main(); no recover() in loader.go/schema.go (grep + trace). Two negative controls stay clean: drilling additionalProperties of a resolved schema loads fine (the existing TestIssue376 happy path), and a normal recursive schema loads fine, so the nil Value is specifically the cause. I independently re-confirmed at HEAD that loader.go:455 dereferences c.Value.AdditionalProperties with no nil-check on c.Value. NOT verified: I did not enumerate every consumer's recover posture.\n\nSuggested fix\n-------------\nAdd if c.Value == nil { break } (fall through to the nil-safe drillIntoField) before touching c.Value.AdditionalProperties. One line.\n\nAlso cleared (stated, not claimed)\n----------------------------------\nThe allOf/anyOf $ref diamond does not blow up: Schema.validate threads its stack through the return and never pops it, acting as a global pointer-keyed visited-set (executed N=10..30, microseconds). External-ref SSRF/path-traversal is blocked by default (IsExternalRefsAllowed=false); the known custom-ReadFromURIFunc bypass is the already-banked downstream oasdiff item.\n\nAdvisory-source note\n--------------------\nFive-source enumeration: every kin-openapi advisory (CVE-2025-30153 plus the five fresh July-2026 GHSAs) is in openapi3filter (request validation); this finding is in the openapi3 loader, untouched by that systematic reporter and flagged un-analyzed by the prior oasdiff scout. Not contested on the loader surface as of today (a systematic hunter could pivot, so it decays; submit reasonably promptly).\n\nDedup\n-----\nDedup gate clean: no kin-openapi loader verdict in COVERED-INDEX, DISCLOSURE-INDEX or SCOUT-EXCLUDE (the one DISCLOSURE-INDEX hit is report #313, the downstream oasdiff, a different repo/lane).\n\nTooling\n-------\nAI assistance was used while investigating. The panic is executed-verified with negative controls (a one-schema self-referential additionalProperties $ref crashes LoadFromData while a resolved additionalProperties and a normal recursive schema load fine), and I confirmed at HEAD that loader.go:455 dereferences c.Value.AdditionalProperties with no nil-check on c.Value, on a load path with no recover.","categories":["Libraries & packages"],"product":"github.com/getkin/kin-openapi","vendor":"getkin","ecosystem":"go","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-mh7x-f8wq-4jhx","source_modified_at":"2026-10-15T20:16:00Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"go","name":"github.com/getkin/kin-openapi"},"range":"<= 0.144.0"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100348","source_modified_at":"2026-10-15T15:44:17.041Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"kin-openapi","vendor":"getkin","versions":[{"version":"< 0.145.0","status":"affected"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-mh7x-f8wq-4jhx","source_modified_at":"2026-10-15T20:30:07.050954802Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"github.com/getkin/kin-openapi","ecosystem":"Go","purl":"pkg:golang/github.com/getkin/kin-openapi"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.145.0"}]}],"versions":[]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-mh7x-f8wq-4jhx","source_modified_at":"2026-10-15T20:16:00Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"go","name":"github.com/getkin/kin-openapi"},"version":"0.145.0"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-mh7x-f8wq-4jhx","source_modified_at":"2026-10-15T20:30:07.050954802Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"github.com/getkin/kin-openapi","ecosystem":"Go","purl":"pkg:golang/github.com/getkin/kin-openapi"},"version":"0.145.0"}],"cvss":5.3,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00372,"percentile":0.29928,"score_date":"2026-10-23"},"published_at":"2026-10-15T15:31:19.904Z","modified_at":"2026-10-15T20:30:07.050954802Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-mh7x-f8wq-4jhx","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-15T20:16:00Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-100348","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-15T15:44:17.041Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-mh7x-f8wq-4jhx","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-15T20:30:07.050954802Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100348","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/getkin/kin-openapi/security/advisories/GHSA-mh7x-f8wq-4jhx","tags":["x_refsource_CONFIRM"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100348","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://github.com/getkin/kin-openapi/commit/88aa64c7cbd03ecadbb419c473bdcaa8b0124c6b","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/getkin/kin-openapi/releases/tag/v0.145.0","tags":["x_refsource_MISC"]},{"url":"https://github.com/advisories/GHSA-mh7x-f8wq-4jhx","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","assessed_at":"2026-10-15T15:44:05.626471Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-15T20:30:07.050954802Z","content_hash":"bb95ad1e877ce1e81a0d00706cea63fadfd7c4f9f789370b16d276eae11d7189"}}