Detections
Analytics

SCA: security update for github.com/getkin/kin-openapi (GHSA-fh4f-47mf-f2gj)

medium Tenable Cloud Security Plugin ID 474689

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3filter.ValidationHandler
 uses the routers/legacy router, which passes an unsupported or non-canonical HTTP method for an existing
 static path to openapi3.PathItem.GetOperation. The default branch of GetOperation panics before
 authentication runs, so an unauthenticated remote client can repeatedly send methods such as PROPFIND or
 lowercase get to abort connections and generate stack-trace log growth. The specific panic requires an
 exact static path; a concrete path matched only by a templated route does not reach the same sink. This
 issue is fixed in version 0.145.0. (CVE-2026-100347)

Solution

Update the github.com/getkin/kin-openapi library and its related packages to version 0.145.0 or later.

See Also

https://github.com/advisories/GHSA-fh4f-47mf-f2gj

Plugin Details

Severity: Medium

ID: 474689

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 10/16/2026

Updated: 10/16/2026

Risk Information

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS Score Source: CVE-2026-100347

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Temporal Score: 4.6

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/15/2026

Vulnerability Publication Date: 10/15/2026

Reference Information

CVE: CVE-2026-100347