Provisional finding. Full causal and release verification remains incomplete.
The same AI-co-authored 0.136.0 changes behind GHSA-P6WJ-QRR4-PGH5 also let arrays without items reach kin-openapi's query, deepObject and urlencoded decoders, which assume an items schema. Test runs show 0.135.0 rejects the document, 0.136.0 and 0.148.0 panic, and 0.149.0 is fixed.
AI-assisted change
The AI-co-authored 0.136.0 change adds the new 3.1 keywords and relaxes validation, so a legal 3.1 array declared without items is accepted rather than rejected. The query, deepObject and urlencoded decoders it then reaches are older human-written code.
Root cause
Those decoders assume an items schema is present, so a request supplying array values for a parameter whose schema omits items makes them dereference a nil items schema and panic. Unauthenticated validation then crashes instead of returning an error.
Fix
parseArray and buildResObj now check for a missing items schema and return a clean decoding error, so the request is rejected with an error rather than crashing the process.
Case facts
ClaudeCite this finding
Vibe Security Radar, "CVE-2026-100353 in getkin/kin-openapi," Georgia Tech SSLab, https://vibesecradar.com/cves/CVE-2026-100353/
@@ -873,6 +873,92 @@ func (schema Schema) JSONLookup(token string) (any, error) { return schema.MaxProps, nil case "discriminator": return schema.Discriminator, nil++ // OpenAPI 3.1 / JSON Schema 2020-12 fields+ case "const":+ return schema.Const, nil+ case "examples":+ return schema.Examples, nil+ case "prefixItems":+ return schema.PrefixItems, nil+ case "contains":+ if schema.Contains != nil {+ if schema.Contains.Ref != "" {+ return &Ref{Ref: schema.Contains.Ref}, nil+ }+ return schema.Contains.Value, nil+ }+ case "minContains":+ return schema.MinContains, nil+ case "maxContains":+ return schema.MaxContains, nil+ case "patternProperties":+ return schema.PatternProperties, nil+ case "dependentSchemas":+ return schema.DependentSchemas, nil+ case "propertyNames":+ if schema.PropertyNames != nil {+ if schema.PropertyNames.Ref != "" {+ return &Ref{Ref: schema.PropertyNames.Ref}, nil+ }+ return schema.PropertyNames.Value, nil+ }+ case "unevaluatedItems":+ if schema.UnevaluatedItems != nil {+ if schema.UnevaluatedItems.Ref != "" {+ return &Ref{Ref: schema.UnevaluatedItems.Ref}, nil+ }+ return schema.UnevaluatedItems.Value, nil+ }+ case "unevaluatedProperties":+ if schema.UnevaluatedProperties != nil {+ if schema.UnevaluatedProperties.Ref != "" {+ return &Ref{Ref: schema.UnevaluatedProperties.Ref}, nil+ }+ return schema.UnevaluatedProperties.Value, nil+ }+ case "if":+ if schema.If != nil {+ if schema.If.Ref != "" {+ return &Ref{Ref: schema.If.Ref}, nil+ }+ return schema.If.Value, nil+ }+ case "then":+ if schema.Then != nil {+ if schema.Then.Ref != "" {+ return &Ref{Ref: schema.Then.Ref}, nil+ }+ return schema.Then.Value, nil+ }+ case "else":+ if schema.Else != nil {+ if schema.Else.Ref != "" {+ return &Ref{Ref: schema.Else.Ref}, nil+ }+ return schema.Else.Value, nil+ }+ case "dependentRequired":+ return schema.DependentRequired, nil+ case "$id":+ return schema.SchemaID, nil+ case "$anchor":+ return schema.Anchor, nil+ case "$dynamicRef":+ return schema.DynamicRef, nil+ case "$dynamicAnchor":+ return schema.DynamicAnchor, nil+ case "contentMediaType":+ return schema.ContentMediaType, nil+ case "contentEncoding":+ return schema.ContentEncoding, nil+ case "contentSchema":+ if schema.ContentSchema != nil {+ if schema.ContentSchema.Ref != "" {+ return &Ref{Ref: schema.ContentSchema.Ref}, nil+ }+ return schema.ContentSchema.Value, nil+ }@@ -588,6 +588,9 @@ func (d *urlValuesDecoder) DecodeArray(param string, sm *openapi3.SerializationM // Every item is parsed as a primitive value. // The function returns an error when an error happened while parse array's items. func (d *urlValuesDecoder) parseArray(raw []string, schemaRef *openapi3.SchemaRef) ([]any, error) {+ if schemaRef.Value.Items == nil || schemaRef.Value.Items.Value == nil {+ return nil, errors.New("array items schema is required for decoding")+ } var value []any for i, v := range raw {@@ -1036,6 +1039,9 @@ func buildResObj(params map[string]any, parentKeys []string, key string, schema switch { case schema.Value.Type.Is("array"):+ if schema.Value.Items == nil || schema.Value.Items.Value == nil {+ return nil, &ParseError{path: pathFromKeys(mapKeys), Kind: KindOther, Reason: "array items schema is required"}+ } paramArr, ok := deepGet(params, mapKeys...) if !ok { return nil, nilAI-assisted change e6065ad98c43c4ab024c9ec949c4ebda86444ad1b6fe7740bbe305803ce80aee · Fix f7a4f582c8e4a130fd8ba45e0e8b06269d1a195b196fe81725f8a6e58196b928
CVE-2026-100352Oct 15, 2026getkin/kin-openapi
GoClaudeFlawed AI-written codeValidation & fail-open logic
CVE-2026-97394Oct 15, 2026getkin/kin-openapiGoClaudeFlawed AI-written codeValidation & fail-open logic