Cloudanix VulnDB

CVE-2026-100353

High · 7.5

CVSS

7.5

EPSS

0.3%

Published

Oct 15, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in a library used by some web applications can let anyone on the internet crash the service by sending specially crafted web requests, causing downtime until fixed.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Trivial
Impact
Denial Of Service
Component
Library
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Missing nil-items guard in openapi3filter decoder paths (urlValuesDecoder.parseArray and buildResObj) allows unauthenticated remote clients to trigger deterministic nil-pointer panic when processing legal OpenAPI 3.1 array schemas inside query parameters, deepObject query parameters, or application/x-www-form-urlencoded bodies containing allOf/anyOf/oneOf subschemas.

Why it matters to the business

Remote unauthenticated denial-of-service causing service crashes and operational downtime for applications using vulnerable kin-openapi versions; affected Red Hat-packaged Grafana and Hugo deployments require urgent patching per RHSA-2026:82637.

How an attack unfolds

An attacker sends a crafted HTTP request containing an array query parameter, deepObject array property, or form-urlencoded body whose array property is nested inside an allOf/anyOf/oneOf subschema; the request reaches a decoder path lacking the nil-items guard, dereferences a nil schema, and panics the Go process.

How to fix it

Upgrade kin-openapi to 0.149.0 or later; for Red Hat packages apply grafana13-1-main to 13.1.8-0.3.hum1, grafana13-2-main to 13.2.3-0.3.hum1, or hugo-main to 0.168.0-0.1.hum1 via RHSA-2026:82637.

How to confirm the fix worked

Verify deployed package versions match the fixed releases listed in RHSA-2026:82637; re-test affected decoder paths with previously crashing array-parameter payloads to confirm absence of panic.

Typical attack path

  1. Identify target endpoint accepting query or form parameters validated via kin-openapi openapi3filter
  2. Craft request with array query parameter, deepObject array, or form-urlencoded array inside composed subschema
  3. Send request to trigger parseArray or buildResObj with nil items schema
  4. Observe deterministic nil-pointer panic and service crash

How to detect it

Search application and Go runtime logs for nil-pointer panic stack traces mentioning urlValuesDecoder.parseArray or buildResObj shortly after receipt of query or form requests; correlate with openapi3filter usage in request-handling paths.

  • panic: runtime error: invalid memory address or nil pointer dereference
  • urlValuesDecoder.parseArray
  • buildResObj

What your security team should do

  • Immediately apply the Red Hat security updates for affected Grafana and Hugo packages
  • Scan all Go services for kin-openapi versions between 0.136.0 and 0.149.0
  • Add runtime monitoring for Go panics originating from openapi3filter decoder functions
  • Prioritize upgrade within the next 30 days given recent publication and high availability impact

The record

kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.149.0, three openapi3filter decoder paths that were missed by the fix for GHSA-p6wj-qrr4-pgh5 lack a nil-items guard for legal OpenAPI 3.1 array schemas. An unauthenticated remote client can trigger a deterministic nil-pointer panic through an array query parameter, a deepObject query parameter containing an array property, or an application/x-www-form-urlencoded request body whose array property appears inside an allOf, anyOf, or oneOf subschema. The query and composed-body paths reach urlValuesDecoder.parseArray, while the deepObject path reaches buildResObj, and all pass a nil items schema into code that dereferences it. This issue is fixed in version 0.149.0.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities