kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.149.0, three openapi3filter decoder paths that were missed by the fix for GHSA-p6wj-qrr4-pgh5 lack a nil-items guard for legal OpenAPI 3.1 array schemas. An unauthenticated remote client can trigger a deterministic nil-pointer panic through an array query parameter, a deepObject query parameter containing an array property, or an application/x-www-form-urlencoded request body whose array property appears inside an allOf, anyOf, or oneOf subschema. The query and composed-body paths reach urlValuesDecoder.parseArray, while the deepObject path reaches buildResObj, and all pass a nil items schema into code that dereferences it. This issue is fixed in version 0.149.0.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.149.0, three openapi3filter     decoder paths that were missed by the fix for GHSA-p6wj-qrr4-pgh5 lack a nil-items guard for legal OpenAPI     3.1 array schemas. An unauthenticated remote client can trigger a deterministic nil-pointer panic through     an array query parameter, a deepObject query parameter containing an array property, or an     application/x-www-form-urlencoded request body whose array property appears inside an allOf, anyOf, or     oneOf subschema. The query and composed-body paths reach urlValuesDecoder.parseArray, while the deepObject     path reaches buildResObj, and all pass a nil items schema into code that dereferences it. This issue is     fixed in version 0.149.0. (CVE-2026-100353)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.149.0, three openapi3filter
    decoder paths that were missed by the fix for GHSA-p6wj-qrr4-pgh5 lack a nil-items guard for legal OpenAPI
    3.1 array schemas. An unauthenticated remote client can trigger a deterministic nil-pointer panic through
    an array query parameter, a deepObject query parameter containing an array property, or an
    application/x-www-form-urlencoded request body whose array property appears inside an allOf, anyOf, or
    oneOf subschema. The query and composed-body paths reach urlValuesDecoder.parseArray, while the deepObject
    path reaches buildResObj, and all pass a nil items schema into code that dereferences it. This issue is
    fixed in version 0.149.0. (CVE-2026-100353)

ID	Name	Product	Family	Type	Severity
366845	Linux Distros Unpatched Vulnerability : CVE-2026-100353	Nessus	Misc.	Local	high
474701	SCA: security update for github.com/getkin/kin-openapi (GHSA-vrcc-3ch7-hppw)	Tenable Cloud Security	SCA Checks	Local	high
474701	SCA: security update for github.com/getkin/kin-openapi (GHSA-vrcc-3ch7-hppw)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-100353

high

Tenable Plugins

high

high

high