A Claude-co-authored change turned on JSON Schema 2020-12 validation by default for OpenAPI 3.1 requests, routing them through a human-written path that skipped the NaN/Inf guard and crashed.

How AI contributed: Flawed AI-written codePublished Oct 15, 2026 in getkin/kin-openapiAll 3 findings in this repository

Provisional finding. Full causal and release verification remains incomplete.

What actually happened

A contributor's earlier code added a JSON Schema 2020-12 path that skipped kin-openapi's NaN/Inf guard. The AI-co-authored change enabled it by default for OpenAPI 3.1 documents, so YAML .nan or .inf values reached jsonschema v6.0.2 and panicked. Affected 0.136.0 to 0.147.0; 0.148.0 updates jsonschema.

AI-assisted change

The AI-co-authored change turns on EnableJSONSchema2020 for OpenAPI 3.1 request and response validation, activating an earlier contributor-written path that skipped the NaN and Inf guard.

Root cause

YAML NaN and Inf values reach unguarded validation

An OpenAPI 3.1 request containing .nan, .inf, or -.inf is passed to jsonschema v6.0.2, which dereferences a nil big.Rat in numValidate and panics, enabling unauthenticated denial of service.

AI-assisted change: Claude

1e54f1a715

openapi3filter/validate_response.go openapi3filter/validate_request.go

Fix

Fix bumps jsonschema to v6.0.3

Release 0.148.0 updates the jsonschema module to v6.0.3, which rejects NaN and Inf numbers with a normal validation error instead of panicking.

Fix authorship not yet analyzed

4487f198ab

go.mod

Case facts

CVE ID: CVE-2026-100352
GHSA ID: GHSA-RJ39-CV6W-8WV7
Published: Oct 15, 2026
Severity: Not scored
Language: Go
AI tool: Claude
AI role: Flawed AI-written code
Root cause: Validation & fail-open logic
Vulnerable release: v0.136.0 through v0.147.0 (advisory range < 0.148.0)
Fixed release: v0.148.0

Advisory source Suggest a correction

Cite this finding

Vibe Security Radar, "CVE-2026-100352 in getkin/kin-openapi," Georgia Tech SSLab, https://vibesecradar.com/cves/CVE-2026-100352/

AI-assisted change

AI-assisted changeopenapi3filter/validate_response.go source getkin/kin-openapi@1e54f1a715+3−0

@@ -75,6 +75,9 @@ func ValidateResponse(ctx context.Context, input *ResponseValidationInput) error 	} 	// Append additional schema validation options (e.g., document-scoped format validators) 	opts = append(opts, options.SchemaValidationOptions...)+	if route.Spec != nil && route.Spec.IsOpenAPI3_1() {+		opts = append(opts, openapi3.EnableJSONSchema2020())+	}  	headers := make([]string, 0, len(response.Headers))

Show 1 hidden lines

 	for k := range response.Headers {

In ValidateResponse, the code appends EnableJSONSchema2020 when the route's spec is OpenAPI 3.1, routing response validation through the schema path that skips the NaN and Inf guard.

AI-assisted changeopenapi3filter/validate_request.go source getkin/kin-openapi@1e54f1a715+6−0

@@ -240,6 +240,9 @@ func ValidateParameter(ctx context.Context, input *RequestValidationInput, param 	if options.customSchemaErrorFunc != nil { 		opts = append(opts, openapi3.SetSchemaErrorMessageCustomizer(options.customSchemaErrorFunc)) 	}+	if input.Route != nil && input.Route.Spec != nil && input.Route.Spec.IsOpenAPI3_1() {+		opts = append(opts, openapi3.EnableJSONSchema2020())+	} 	if err = schema.VisitJSON(value, opts...); err != nil { 		return &RequestError{Input: input, Parameter: parameter, Err: err}

Show 2 hidden lines

 	}@@ -349,6 +352,9 @@ func ValidateRequestBody(ctx context.Context, input *RequestValidationInput, req

 	} 	// Append additional schema validation options (e.g., document-scoped format validators) 	opts = append(opts, options.SchemaValidationOptions...)+	if input.Route != nil && input.Route.Spec != nil && input.Route.Spec.IsOpenAPI3_1() {+		opts = append(opts, openapi3.EnableJSONSchema2020())+	}  	// Validate JSON with the schema

Show 1 hidden lines

 	if err := contentType.Schema.Value.VisitJSON(value, opts...); err != nil {

In ValidateParameter and ValidateRequestBody, this enables JSON Schema 2020 for OpenAPI 3.1 routes, so YAML .nan or .inf values reach the unguarded jsonschema path and can panic.

Security fix

Fixgo.mod source getkin/kin-openapi@4487f198ab+1−1

@@ -7,7 +7,7 @@ require ( 	github.com/gorilla/mux v1.8.0 	github.com/oasdiff/yaml v0.1.1 	github.com/oasdiff/yaml3 v0.0.14-	github.com/santhosh-tekuri/jsonschema/v6 v6.0.2+	github.com/santhosh-tekuri/jsonschema/v6 v6.0.3 	github.com/stretchr/testify v1.9.0 )

The fix bumps the jsonschema module from v6.0.2 to v6.0.3, the release that returns a validation error instead of panicking on NaN and Inf numbers.

Patch fingerprints

AI-assisted change e558fdd6a5517aeaf09a906731bbd0f81858e3b20f08acf491c3ea71b6177b45 · Fix 4e8ffb6199e3cf2d365734373a4bb2538dc4803ce5fdc2ceff15445d43a46729

Claude-co-authored changes let OpenAPI 3.1 arrays without items pass validation, so query, deepObject and urlencoded requests reached human-written decoders that crash, until 0.149.0.
CVE-2026-100353Oct 15, 2026getkin/kin-openapiGoClaudeFlawed AI-written codeInjection & unsafe execution
Claude-co-authored changes stopped requiring items on OpenAPI 3.1 arrays and made that the default, so requests reached human-written decoders that crash when the items schema is missing.
CVE-2026-97394Oct 15, 2026getkin/kin-openapiGoClaudeFlawed AI-written codeValidation & fail-open logic

A Claude-co-authored change turned on JSON Schema 2020-12 validation by default for OpenAPI 3.1 requests, routing them through a human-written path that skipped the NaN/Inf guard and crashed.

Provisional finding. Full causal and release verification remains incomplete.

What actually happened

AI-assisted change

AI-assisted changeopenapi3filter/validate_response.go source getkin/kin-openapi@1e54f1a715+3−0

@@ -75,6 +75,9 @@ func ValidateResponse(ctx context.Context, input *ResponseValidationInput) error 	} 	// Append additional schema validation options (e.g., document-scoped format validators) 	opts = append(opts, options.SchemaValidationOptions...)+	if route.Spec != nil && route.Spec.IsOpenAPI3_1() {+		opts = append(opts, openapi3.EnableJSONSchema2020())+	}  	headers := make([]string, 0, len(response.Headers))

Show 1 hidden lines

 	for k := range response.Headers {

In ValidateResponse, the code appends EnableJSONSchema2020 when the route's spec is OpenAPI 3.1, routing response validation through the schema path that skips the NaN and Inf guard.

AI-assisted changeopenapi3filter/validate_request.go source getkin/kin-openapi@1e54f1a715+6−0

@@ -240,6 +240,9 @@ func ValidateParameter(ctx context.Context, input *RequestValidationInput, param 	if options.customSchemaErrorFunc != nil { 		opts = append(opts, openapi3.SetSchemaErrorMessageCustomizer(options.customSchemaErrorFunc)) 	}+	if input.Route != nil && input.Route.Spec != nil && input.Route.Spec.IsOpenAPI3_1() {+		opts = append(opts, openapi3.EnableJSONSchema2020())+	} 	if err = schema.VisitJSON(value, opts...); err != nil { 		return &RequestError{Input: input, Parameter: parameter, Err: err}

Show 2 hidden lines

 	}@@ -349,6 +352,9 @@ func ValidateRequestBody(ctx context.Context, input *RequestValidationInput, req

 	} 	// Append additional schema validation options (e.g., document-scoped format validators) 	opts = append(opts, options.SchemaValidationOptions...)+	if input.Route != nil && input.Route.Spec != nil && input.Route.Spec.IsOpenAPI3_1() {+		opts = append(opts, openapi3.EnableJSONSchema2020())+	}  	// Validate JSON with the schema

Show 1 hidden lines

 	if err := contentType.Schema.Value.VisitJSON(value, opts...); err != nil {

In ValidateParameter and ValidateRequestBody, this enables JSON Schema 2020 for OpenAPI 3.1 routes, so YAML .nan or .inf values reach the unguarded jsonschema path and can panic.

Security fix

Fixgo.mod source getkin/kin-openapi@4487f198ab+1−1

@@ -7,7 +7,7 @@ require ( 	github.com/gorilla/mux v1.8.0 	github.com/oasdiff/yaml v0.1.1 	github.com/oasdiff/yaml3 v0.0.14-	github.com/santhosh-tekuri/jsonschema/v6 v6.0.2+	github.com/santhosh-tekuri/jsonschema/v6 v6.0.3 	github.com/stretchr/testify v1.9.0 )

The fix bumps the jsonschema module from v6.0.2 to v6.0.3, the release that returns a validation error instead of panicking on NaN and Inf numbers.

A Claude-co-authored change turned on JSON Schema 2020-12 validation by default for OpenAPI 3.1 requests, routing them through a human-written path that skipped the NaN/Inf guard and crashed.

YAML NaN and Inf values reach unguarded validation

Fix bumps jsonschema to v6.0.3

AI-assisted change

Security fix

More findings in getkin/kin-openapi

A Claude-co-authored change turned on JSON Schema 2020-12 validation by default for OpenAPI 3.1 requests, routing them through a human-written path that skipped the NaN/Inf guard and crashed.

YAML NaN and Inf values reach unguarded validation

Fix bumps jsonschema to v6.0.3

AI-assisted change

Security fix

More findings in getkin/kin-openapi