Improper Check for Unusual or Exceptional Conditions in kin-openapi - #VU146053
Published: August 28, 2026
Vulnerability identifier: #VU146053
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-754
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper check for unusual or exceptional conditions in the OAS 3.1 schema validation path when processing YAML request bodies containing NaN or Inf values under numeric constraints. A remote attacker can send a specially crafted HTTP request to cause a denial of service.
Exploitation requires an OAS 3.1 API endpoint that accepts application/yaml or application/x-yaml request bodies and applies numeric constraints such as minimum, maximum, exclusiveMinimum, exclusiveMaximum, or multipleOf.
Affected software
kin-openapi
Remediation
Install security update from vendor's website.
kin-openapi - update to 0.148.0