CVE catalog

CVE-2026-100347

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3filter.ValidationHandler uses the routers/legacy router, which passes an unsupported or non-canonical HTTP method for

[CVE catalog]

Severity: High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published: Oct 6, 2026, 8:26:00 AM UTC
Updated: Oct 15, 2026, 4:17:30 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.52% · Oct 25, 2026

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3filter.ValidationHandler uses the routers/legacy router, which passes an unsupported or non-canonical HTTP method for an existing static path to openapi3.PathItem.GetOperation. The default branch of GetOperation panics before authentication runs, so an unauthenticated remote client can repeatedly send methods such as PROPFIND or lowercase get to abort connections and generate stack-trace log growth. The specific panic requires an exact static path; a concrete path matched only by a templated route does not reach the same sink. This issue is fixed in version 0.145.0.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	golang-github-getkin-kin-openapi	sid	`0.135.0-1`	vulnerable
Debian	golang-github-getkin-kin-openapi	forky	`0.135.0-1`	vulnerable
Debian	golang-github-getkin-kin-openapi	trixie	`0.124.0-1`	vulnerable
Debian	golang-github-getkin-kin-openapi	bookworm	`0.110.0-1`	vulnerable
Go	github.com/getkin/kin-openapi	Not reported	`0.145.0`	fixed
Opensuse	hugo	tumbleweed	`0.168.0-2.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	golang-github-getkin-kin-openapi	source	sid	`(unfixed)`	not yet assigned	Not reported	[1151207]
Debian	golang-github-getkin-kin-openapi	source	forky	`(unfixed)`	not yet assigned	Not reported	[1151207]
Debian	golang-github-getkin-kin-openapi	source	trixie	`(unfixed)`	not yet assigned	Not reported	[1151207]
Debian	golang-github-getkin-kin-openapi	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1151207]
Go	github.com/getkin/kin-openapi	Go	Not reported	`0.145.0`	Not reported	GHSA-FH4F-47MF-F2GJ	Not reported
Opensuse	hugo	rpm	tumbleweed	`0.168.0-2.1`	Not reported	OPENSUSE-SU-2026:12164-1	Not reported

[Debian bug #1151207]

Notes

[trixie] golang-github-getkin-kin-openapi: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[golang-github-getkin-kin-openapi-dev]Affected
Source package: [golang-github-getkin-kin-openapi]
Details (2)
- 0.110.0-1 · all · bookworm
  Affected
  nvd · golang-github-getkin-kin-openapi · debian · bookworm
- 0.110.0-1 · all · bookworm
  Affected
  nvd · golang-github-getkin-kin-openapi · debian · bookworm

[openSUSE Tumbleweed]

[hugo]Affected
Source package: [hugo]
Details (1)
- 0.165.0-1.1 · x86_64 · tumbleweed
  Affected · Fixed: 0.168.0-2.1
  nvd · hugo · opensuse · tumbleweed
[hugo-bash-completion]Unknown
Source package: [hugo]
Details (1)
- 0.165.0-1.1 · noarch · tumbleweed
  Unknown · Fixed: 0.168.0-2.1
  Version impact unknown
  nvd · hugo · opensuse · tumbleweed
[hugo-zsh-completion]Unknown
Source package: [hugo]
Details (1)
- 0.165.0-1.1 · noarch · tumbleweed
  Unknown · Fixed: 0.168.0-2.1
  Version impact unknown
  nvd · hugo · opensuse · tumbleweed

Observed: Oct 24, 2026, 12:09:51 AM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]