{"id":"GHSA-mh7x-f8wq-4jhx","summary":"kin-openapi spec loader panics on a self-referential additionalProperties $ref (nil-pointer DoS)","details":"The defect\n----------\nConfirmed at HEAD (f0407d5, v0.144.0). openapi3/loader.go, inside resolveComponent's drill closure (around line 455), the case *SchemaRef branch for pathPart == \"additionalProperties\" dereferences c.Value.AdditionalProperties with no nil-check on c.Value:\n\n    case *SchemaRef:\n        if pathPart == \"additionalProperties\" {\n            if ap := c.Value.AdditionalProperties.Has; ap != nil {   // c.Value can be nil here\n                cursor = *ap\n            } else {\n                cursor = c.Value.AdditionalProperties.Schema\n            }\n            attempted = true\n        }\n\nWhen a $ref fragment drills through .../additionalProperties of a schema whose Value is still nil (a pure, not-yet-resolved $ref, or a self-reference resolved before its own Value is set), c.Value is nil and the .AdditionalProperties access panics.\n\nInput and attacker\n-------------------\nA tiny crafted OpenAPI document, one schema, no external refs, no network:\n\n    openapi: 3.0.3\n    info: {title: t, version: \"1.0.0\"}\n    paths: {}\n    components:\n      schemas:\n        A:\n          $ref: '#/components/schemas/A/additionalProperties'\n\nAttacker model: any service or tool that loads an untrusted spec via the default openapi3.Loader (LoadFromData / LoadFromFile / LoadFromURI), e.g. a spec registry, an API-management platform ingesting user specs, a linter, or a converter. It crashes during LOAD (ResolveRefsIn), before Validate.\n\nVerification level\n------------------\nEXECUTED with negative controls (agent-run go test at HEAD f0407d5, including yesterday's security merge; the bug is still present). The full stack pins LoadFromData:196 -\u003e ResolveRefsIn:274 -\u003e resolveSchemaRef:1048 -\u003e resolveComponent:485 -\u003e drill:439 -\u003e :455, propagating to main(); no recover() in loader.go/schema.go (grep + trace). Two negative controls stay clean: drilling additionalProperties of a resolved schema loads fine (the existing TestIssue376 happy path), and a normal recursive schema loads fine, so the nil Value is specifically the cause. I independently re-confirmed at HEAD that loader.go:455 dereferences c.Value.AdditionalProperties with no nil-check on c.Value. NOT verified: I did not enumerate every consumer's recover posture.\n\nSuggested fix\n-------------\nAdd if c.Value == nil { break } (fall through to the nil-safe drillIntoField) before touching c.Value.AdditionalProperties. One line.\n\nAlso cleared (stated, not claimed)\n----------------------------------\nThe allOf/anyOf $ref diamond does not blow up: Schema.validate threads its stack through the return and never pops it, acting as a global pointer-keyed visited-set (executed N=10..30, microseconds). External-ref SSRF/path-traversal is blocked by default (IsExternalRefsAllowed=false); the known custom-ReadFromURIFunc bypass is the already-banked downstream oasdiff item.\n\nAdvisory-source note\n--------------------\nFive-source enumeration: every kin-openapi advisory (CVE-2025-30153 plus the five fresh July-2026 GHSAs) is in openapi3filter (request validation); this finding is in the openapi3 loader, untouched by that systematic reporter and flagged un-analyzed by the prior oasdiff scout. Not contested on the loader surface as of today (a systematic hunter could pivot, so it decays; submit reasonably promptly).\n\nDedup\n-----\nDedup gate clean: no kin-openapi loader verdict in COVERED-INDEX, DISCLOSURE-INDEX or SCOUT-EXCLUDE (the one DISCLOSURE-INDEX hit is report #313, the downstream oasdiff, a different repo/lane).\n\nTooling\n-------\nAI assistance was used while investigating. The panic is executed-verified with negative controls (a one-schema self-referential additionalProperties $ref crashes LoadFromData while a resolved additionalProperties and a normal recursive schema load fine), and I confirmed at HEAD that loader.go:455 dereferences c.Value.AdditionalProperties with no nil-check on c.Value, on a load path with no recover.","aliases":["CVE-2026-100348"],"modified":"2026-10-15T20:30:07.050954802Z","published":"2026-10-15T20:15:58Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2026-10-15T20:15:58Z","nvd_published_at":"2026-10-15T16:17:30Z","cwe_ids":["CWE-476"],"severity":"MODERATE"},"references":[{"type":"WEB","url":"https://github.com/getkin/kin-openapi/security/advisories/GHSA-mh7x-f8wq-4jhx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100348"},{"type":"WEB","url":"https://github.com/getkin/kin-openapi/commit/88aa64c7cbd03ecadbb419c473bdcaa8b0124c6b"},{"type":"PACKAGE","url":"https://github.com/getkin/kin-openapi"},{"type":"WEB","url":"https://github.com/getkin/kin-openapi/releases/tag/v0.145.0"}],"affected":[{"package":{"name":"github.com/getkin/kin-openapi","ecosystem":"Go","purl":"pkg:golang/github.com/getkin/kin-openapi"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.145.0"}]}],"database_specific":{"last_known_affected_version_range":"\u003c= 0.144.0","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-mh7x-f8wq-4jhx/GHSA-mh7x-f8wq-4jhx.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}]}