Root cause
Decoders dereference nil array items
The urlencoded, multipart and parseArray decoders dereference the nil Items field, so any request reaching an affected operation panics.
Claude-co-authored changes stopped requiring items on OpenAPI 3.1 arrays and made that the default, so requests reached human-written decoders that crash when the items schema is missing.
Provisional finding. Full causal and release verification remains incomplete.
What actually happenedHide details
kin-openapi's urlencoded, multipart and array decoders, written in 2019, assume every array schema has items. The AI-co-authored 0.136.0 changes accepted OpenAPI 3.1 arrays without items and enabled that mode by default, so a request to such an operation panics. 0.135.0 rejects the document; 0.143.0 fixes these decoders.
AI-assisted change
The human-written 2019 decoders already assumed every array had items; the AI-co-authored 0.136.0 change expanded 3.1 schema handling and enabled it by default, letting arrays without items reach them.
Fix
Fix adds nil checks in array decoders
The repair returns errors from parseArray, UrlencodedBodyDecoder and MultipartBodyDecoder when an array schema has no items, so requests no longer panic.
Case facts
- CVE ID
- CVE-2026-97394
- GHSA ID
- GHSA-P6WJ-QRR4-PGH5
- Published
- Oct 15, 2026
- Severity
- Not scored
- Language
- Go
- AI tool
Claude- AI role
- Flawed AI-written code
- Root cause
- Validation & fail-open logic
- Vulnerable release
- v0.136.0 through v0.142.0
- Fixed release
- v0.143.0
Cite this finding
Vibe Security Radar, "CVE-2026-97394 in getkin/kin-openapi," Georgia Tech SSLab, https://vibesecradar.com/cves/CVE-2026-97394/
AI-assisted change
AI-assisted changeopenapi3/schema.gosource getkin/kin-openapi@4cefcc72a2+86−0
@@ -873,6 +873,92 @@ func (schema Schema) JSONLookup(token string) (any, error) { return schema.MaxProps, nil case "discriminator": return schema.Discriminator, nilShow 3 hidden lines
++ // OpenAPI 3.1 / JSON Schema 2020-12 fields+ case "const":+ return schema.Const, nil+ case "examples":+ return schema.Examples, nil+ case "prefixItems":+ return schema.PrefixItems, nil+ case "contains":+ if schema.Contains != nil {+ if schema.Contains.Ref != "" {Show 16 hidden lines
+ return &Ref{Ref: schema.Contains.Ref}, nil+ }+ return schema.Contains.Value, nil+ }+ case "minContains":+ return schema.MinContains, nil+ case "maxContains":+ return schema.MaxContains, nil+ case "patternProperties":+ return schema.PatternProperties, nil+ case "dependentSchemas":+ return schema.DependentSchemas, nil+ case "propertyNames":+ if schema.PropertyNames != nil {+ if schema.PropertyNames.Ref != "" {+ return &Ref{Ref: schema.PropertyNames.Ref}, nil+ }+ return schema.PropertyNames.Value, nil+ }+ case "unevaluatedItems":+ if schema.UnevaluatedItems != nil {+ if schema.UnevaluatedItems.Ref != "" {+ return &Ref{Ref: schema.UnevaluatedItems.Ref}, nil+ }+ return schema.UnevaluatedItems.Value, nil+ }+ case "unevaluatedProperties":+ if schema.UnevaluatedProperties != nil {Show 47 hidden lines
+ if schema.UnevaluatedProperties.Ref != "" {+ return &Ref{Ref: schema.UnevaluatedProperties.Ref}, nil+ }+ return schema.UnevaluatedProperties.Value, nil+ }+ case "if":+ if schema.If != nil {+ if schema.If.Ref != "" {+ return &Ref{Ref: schema.If.Ref}, nil+ }+ return schema.If.Value, nil+ }+ case "then":+ if schema.Then != nil {+ if schema.Then.Ref != "" {+ return &Ref{Ref: schema.Then.Ref}, nil+ }+ return schema.Then.Value, nil+ }+ case "else":+ if schema.Else != nil {+ if schema.Else.Ref != "" {+ return &Ref{Ref: schema.Else.Ref}, nil+ }+ return schema.Else.Value, nil+ }+ case "dependentRequired":+ return schema.DependentRequired, nil+ case "$id":+ return schema.SchemaID, nil+ case "$anchor":+ return schema.Anchor, nil+ case "$dynamicRef":+ return schema.DynamicRef, nil+ case "$dynamicAnchor":+ return schema.DynamicAnchor, nil+ case "contentMediaType":+ return schema.ContentMediaType, nil+ case "contentEncoding":+ return schema.ContentEncoding, nil+ case "contentSchema":+ if schema.ContentSchema != nil {+ if schema.ContentSchema.Ref != "" {+ return &Ref{Ref: schema.ContentSchema.Ref}, nil+ }+ return schema.ContentSchema.Value, nil+ }Extends schema keyword handling for OpenAPI 3.1 and JSON Schema 2020-12; this AI-co-authored support let 3.1 schemas, including arrays without items, be accepted before decoding.
Security fix
Fixopenapi3filter/req_resp_decoder.gosource getkin/kin-openapi@30e292371a+9−0
@@ -1124,6 +1124,9 @@ func pathFromKeys(kk []string) []any { // Every item is parsed as a primitive value. // The function returns an error when an error happened while parse array's items. func parseArray(raw []string, schemaRef *openapi3.SchemaRef) ([]any, error) {+ if schemaRef.Value.Items == nil || schemaRef.Value.Items.Value == nil {+ return nil, fmt.Errorf("array items schema is required for decoding")+ } var value []any for i, v := range raw { item, err := parsePrimitive(v, schemaRef.Value.Items)@@ -1418,6 +1421,9 @@ func UrlencodedBodyDecoder(body io.Reader, header http.Header, schema *openapi3. case propType.Is("object"): return nil, fmt.Errorf("unsupported schema of request body's property %q", propName) case propType.Is("array"):Show 3 hidden lines
+ if propSchema.Value.Items == nil || propSchema.Value.Items.Value == nil {+ return nil, fmt.Errorf("unsupported schema of request body's property %q: array items required", propName)+ } items := propSchema.Value.Items.Value if !(items.Type.Is("string") || items.Type.Is("integer") || items.Type.Is("number") || items.Type.Is("boolean")) { return nil, fmt.Errorf("unsupported schema of request body's property %q", propName)@@ -1561,6 +1567,9 @@ func MultipartBodyDecoder(body io.Reader, header http.Header, schema *openapi3.S } } if valueSchema.Value.Type.Is("array") {Show 6 hidden lines
+ if valueSchema.Value.Items == nil {+ return nil, fmt.Errorf("unsupported schema of multipart part %q: array items required", name)+ } valueSchema = valueSchema.Value.Items } }Adds nil checks for Items in parseArray, UrlencodedBodyDecoder and MultipartBodyDecoder, returning an error instead of dereferencing a missing array items schema.
Patch fingerprints
AI-assisted change d70a18c045bd95fa06454c779f7f94d067254c90c00f443c8c0de6e42791680d · Fix 9255d7797902660335791e71263a4deb12ff1e0fbd10d5bf40869c03b2b7d05d
More findings in getkin/kin-openapi
- Claude-co-authored changes let OpenAPI 3.1 arrays without items pass validation, so query, deepObject and urlencoded requests reached human-written decoders that crash, until 0.149.0.
CVE-2026-100353Oct 15, 2026getkin/kin-openapi
GoClaudeFlawed AI-written codeInjection & unsafe execution - A Claude-co-authored change turned on JSON Schema 2020-12 validation by default for OpenAPI 3.1 requests, routing them through a human-written path that skipped the NaN/Inf guard and crashed.
CVE-2026-100352Oct 15, 2026getkin/kin-openapi
GoClaudeFlawed AI-written codeValidation & fail-open logic