{"items":[{"id":"NVI-00011776","kind":"vulnerability","title":"kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static path","revision":3,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-fh4f-47mf-f2gj","CVE-2026-100347"],"plain_summary":"GitHub lists this reviewed advisory for github.com/getkin/kin-openapi. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-03618067f7202ef7712e1e0bbc20cb7c"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-15T20:15:50.000Z","value":"5.3 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-233608d915c75b0a8b73a4544ffb5716"},{"kind":"CVSS","as_of":"2026-10-15T17:17:07.413Z","value":"5.3 MEDIUM (3.1)","meaning":"security-advisories@github.com severity; no combined Null risk score.","source_id":"sr-1a71ee2812faf710f0e56fe194307bc0"},{"kind":"EPSS","as_of":"2026-11-02T12:00:30.000Z","value":"0.515%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.4387. Missing scores are unknown.","source_id":"sr-03618067f7202ef7712e1e0bbc20cb7c"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-233608d915c75b0a8b73a4544ffb5716","url":"https://github.com/advisories/GHSA-fh4f-47mf-f2gj","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-fh4f-47mf-f2gj","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T23:14:14.588Z"},{"id":"sr-1a71ee2812faf710f0e56fe194307bc0","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100347","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-100347","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-03T09:57:54.204Z"},{"id":"sr-03618067f7202ef7712e1e0bbc20cb7c","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-100347","publisher":"FIRST EPSS","observed_at":"2026-11-02T20:15:58.837Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-233608d915c75b0a8b73a4544ffb5716"],"technology":"github.com/getkin/kin-openapi","known_exclusions":[],"conditions_summary":"## Summary\nThe `openapi3filter.ValidationHandler` (the exported, documented request-validation middleware) hard-wires the legacy router (`routers/legacy`). That router matches the incoming request method verbatim against a trie built exclusively from upper-cased canonical HTTP methods. A request carrying a method token that is not one of the 9 standard methods — a legitimate-but-unsupported token such as `PROPFIND`, or a non-canonical case variant such as lowercase `get` — misses the trie, leaves `route == nil`, and for an existing **static** path falls through to `PathItem.GetOperation(method)`, whose `default:` case calls `panic(...)`. The panic fires inside route resolution, **before any authentication** runs. This is an unauthenticated, remotely triggerable denial of service (recovered per-connection panic + unbounded error-log growth).\n\n## Root Cause\n- `openapi3filter/validation_handler.go:39` — `ValidationHandler.Load()` always constructs `legacyrouter.NewRouter(doc)`; there is no alternative router option on this path.\n- `routers/legacy/router.go:109` — the request method is used verbatim (`method, url := req.Method, ...`); there is no canonicalization or rejection of unknow","public_affected_ranges":["<= 0.144.0"]}],"null_published_at":"2026-11-03T17:49:14.995Z","source_updated_at":"2026-10-15T20:15:50.000Z","source_disclosed_at":"2026-10-15T20:15:48.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-10-31T23:14:14.588Z"},{"id":"NVI-00011776","kind":"vulnerability","title":"kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static path","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-fh4f-47mf-f2gj","CVE-2026-100347"],"plain_summary":"GitHub lists this reviewed advisory for github.com/getkin/kin-openapi. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-1a71ee2812faf710f0e56fe194307bc0"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-15T20:15:50.000Z","value":"5.3 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-233608d915c75b0a8b73a4544ffb5716"},{"kind":"CVSS","as_of":"2026-10-15T17:17:07.413Z","value":"5.3 MEDIUM (3.1)","meaning":"security-advisories@github.com severity; no combined Null risk score.","source_id":"sr-1a71ee2812faf710f0e56fe194307bc0"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-233608d915c75b0a8b73a4544ffb5716","url":"https://github.com/advisories/GHSA-fh4f-47mf-f2gj","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-fh4f-47mf-f2gj","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T23:14:14.588Z"},{"id":"sr-1a71ee2812faf710f0e56fe194307bc0","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100347","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-100347","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-03T09:57:54.204Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-233608d915c75b0a8b73a4544ffb5716"],"technology":"github.com/getkin/kin-openapi","known_exclusions":[],"conditions_summary":"## Summary\nThe `openapi3filter.ValidationHandler` (the exported, documented request-validation middleware) hard-wires the legacy router (`routers/legacy`). That router matches the incoming request method verbatim against a trie built exclusively from upper-cased canonical HTTP methods. A request carrying a method token that is not one of the 9 standard methods — a legitimate-but-unsupported token such as `PROPFIND`, or a non-canonical case variant such as lowercase `get` — misses the trie, leaves `route == nil`, and for an existing **static** path falls through to `PathItem.GetOperation(method)`, whose `default:` case calls `panic(...)`. The panic fires inside route resolution, **before any authentication** runs. This is an unauthenticated, remotely triggerable denial of service (recovered per-connection panic + unbounded error-log growth).\n\n## Root Cause\n- `openapi3filter/validation_handler.go:39` — `ValidationHandler.Load()` always constructs `legacyrouter.NewRouter(doc)`; there is no alternative router option on this path.\n- `routers/legacy/router.go:109` — the request method is used verbatim (`method, url := req.Method, ...`); there is no canonicalization or rejection of unknow","public_affected_ranges":["<= 0.144.0"]}],"null_published_at":"2026-11-03T10:03:31.375Z","source_updated_at":"2026-10-15T20:15:50.000Z","source_disclosed_at":"2026-10-15T20:15:48.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-10-31T23:14:14.588Z"},{"id":"NVI-00011776","kind":"vulnerability","title":"kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static path","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-fh4f-47mf-f2gj","CVE-2026-100347"],"plain_summary":"GitHub lists this reviewed advisory for github.com/getkin/kin-openapi. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-233608d915c75b0a8b73a4544ffb5716"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-15T20:15:50.000Z","value":"5.3 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-233608d915c75b0a8b73a4544ffb5716"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-233608d915c75b0a8b73a4544ffb5716","url":"https://github.com/advisories/GHSA-fh4f-47mf-f2gj","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-fh4f-47mf-f2gj","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T23:14:14.588Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-233608d915c75b0a8b73a4544ffb5716"],"technology":"github.com/getkin/kin-openapi","known_exclusions":[],"conditions_summary":"## Summary\nThe `openapi3filter.ValidationHandler` (the exported, documented request-validation middleware) hard-wires the legacy router (`routers/legacy`). That router matches the incoming request method verbatim against a trie built exclusively from upper-cased canonical HTTP methods. A request carrying a method token that is not one of the 9 standard methods — a legitimate-but-unsupported token such as `PROPFIND`, or a non-canonical case variant such as lowercase `get` — misses the trie, leaves `route == nil`, and for an existing **static** path falls through to `PathItem.GetOperation(method)`, whose `default:` case calls `panic(...)`. The panic fires inside route resolution, **before any authentication** runs. This is an unauthenticated, remotely triggerable denial of service (recovered per-connection panic + unbounded error-log growth).\n\n## Root Cause\n- `openapi3filter/validation_handler.go:39` — `ValidationHandler.Load()` always constructs `legacyrouter.NewRouter(doc)`; there is no alternative router option on this path.\n- `routers/legacy/router.go:109` — the request method is used verbatim (`method, url := req.Method, ...`); there is no canonicalization or rejection of unknow","public_affected_ranges":["<= 0.144.0"]}],"null_published_at":"2026-11-01T01:03:56.603Z","source_updated_at":"2026-10-15T20:15:50.000Z","source_disclosed_at":"2026-10-15T20:15:48.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T23:14:14.588Z"}],"next_cursor":null,"snapshot_revision":"42594"}