{"id":"CVE-2026-100350","summary":"kin-openapi deepObject query decoding repeatedly compiles an invariant regular expression","details":"kin-openapi is a Go project for handling OpenAPI files. From 0.145.0 until 0.146.0, openapi3filter repeatedly calls regexp.MustCompile for the same parameter-name regular expression inside the per-query-key loop in urlValuesDecoder.DecodeObject used to decode a deepObject query parameter. An unauthenticated remote client can send an affected endpoint a request containing many unrelated query keys, causing ValidateRequest to perform work and allocations proportional to the attacker-controlled key count for every deepObject parameter. The expression itself is fixed and this is not regular expression denial of service; the resource consumption comes from loop-invariant recompilation. This issue is fixed in version 0.146.0.","aliases":["GHSA-h4r5-mxv5-8mjc"],"modified":"2026-10-16T02:47:26.800313981Z","published":"2026-10-15T15:37:19.077Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-100350.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-1050","CWE-400","CWE-770"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-100350.json"},{"type":"FIX","url":"https://github.com/getkin/kin-openapi/commit/d090e36b2f1c42c898ba2a687a8f6e25f5ca727f"},{"type":"WEB","url":"https://github.com/getkin/kin-openapi/releases/tag/v0.146.0"},{"type":"ADVISORY","url":"https://github.com/getkin/kin-openapi/security/advisories/GHSA-h4r5-mxv5-8mjc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100350"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/getkin/kin-openapi","events":[{"introduced":"88aa64c7cbd03ecadbb419c473bdcaa8b0124c6b"},{"fixed":"335f4e6abe8ecb82856651f30ed955834d90e15c"}],"database_specific":{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"0.145.0"},{"fixed":"0.146.0"}]}}],"versions":["v0.145.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-100350.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}]}