Race condition in kin-openapi - #VU163000
Published: November 9, 2026
Vulnerability identifier: #VU163000
CSH Severity: Medium
CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-362
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to crash a server using kin-openapi, causing denial of service.
The vulnerability exists due to unsynchronized mutation of shared schema default objects in kin-openapi's request validator when default insertion is enabled and nested defaults require filling. An unauthenticated remote attacker can send concurrent valid requests omitting those properties immediately after the specification is loaded, triggering a race that terminates the entire server process.
Affected software
kin-openapi
Remediation
Install security update from vendor's website.
kin-openapi - update to 0.150.0