Listen to this Post
The kin-openapi library guards against NaN and infinity values within its built-in schema visitor by returning explicit error responses when float64 inputs violate constraints. However, when processing OpenAPI Specification 3.1 documents, schema validation routes through the useJSONSchema2020 validation path, which hands the input value directly to external dependencies without applying identical guards. As a result, standard YAML representations of NaN or infinity tokens flow straight into underlying validators, where parsing routines attempt numeric conversions that silently fail and return a nil pointer reference. Subsequent attempts to evaluate constraints against this nil pointer trigger an unhandled runtime panic in the Go application. Attackers can exploit this behavior remotely by supplying malicious YAML payloads containing special floating-point tokens within HTTP request bodies, potentially leading to connection termination or complete service disruption depending on host server architecture.
DailyCVE Form:
Platform: Go kin-openapi
Version: Prior to 0.148.0
Vulnerability : Nil Pointer Panic
Severity: High
date: 2026-10-15
Prediction: 2026-10-15
What Undercode Say:
The issue stems from an architectural inconsistency in how OpenAPI 3.1 schemas delegate validation tasks compared to legacy schema parsing paths. While traditional visitors include explicit checks for IEEE 754 exceptional values like NaN and infinities, the modern JSON Schema 2020 validator bypasses these checks. Fixing this requires ensuring that all validation paths intercept non-finite floating-point inputs uniformly before they reach low-level mathematical libraries.
Analytics
package main import ( "net/http" "github.com/getkin/kin-openapi/openapi3" "github.com/getkin/kin-openapi/openapi3filter" )
Exploit: (Educational Purposes!)
An attacker can trigger this vulnerability by sending a crafted HTTP request with a YAML content type where a numeric property is assigned a non-finite token value:
curl -X POST "http://localhost:8080/test" \ -H "Content-Type: application/yaml" \ -d ".nan"
Protection: from this CVE
Upgrade the `kin-openapi` library to version `0.148.0` or later, or alternatively update the transitive dependency `[github.com/santhosh-tekuri/jsonschema/v6](https://github.com/santhosh-tekuri/jsonschema/v6)` to version `v6.0.3` or higher to properly handle invalid numeric parsing states.
Impact
Successful exploitation allows unauthenticated remote attackers to cause a denial of service via application crashes or connection resets, disrupting service availability for users of vulnerable API endpoints.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
