SB2026082835 - Improper Check for Unusual or Exceptional Conditions in kin-openapi

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026082835

SB2026082835 - Improper Check for Unusual or Exceptional Conditions in kin-openapi

Published: August 28, 2026

Security Bulletin ID SB2026082835
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Improper Check for Unusual or Exceptional Conditions (CVE-ID: N/A)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper check for unusual or exceptional conditions in the OAS 3.1 schema validation path when processing YAML request bodies containing NaN or Inf values under numeric constraints. A remote attacker can send a specially crafted HTTP request to cause a denial of service.

Exploitation requires an OAS 3.1 API endpoint that accepts application/yaml or application/x-yaml request bodies and applies numeric constraints such as minimum, maximum, exclusiveMinimum, exclusiveMaximum, or multipleOf.


Remediation

Install update from vendor's website.

References