CVE-2026-97394
kin-openapi0/100
no exploitation signal
kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.143.0, openapi3filter accepts OpenAPI 3.1 array schemas without an items keyword and then dereferences the nil Schema.Items value while decoding application/x-www-form-urlencoded or multipart/form-data request bodies, response headers, and other array parameter surfaces. A remote unauthenticated client can reach an affected operation with a nonempty request or matching response and deterministically trigger a nil-pointe
No EPSS/KEV signal · CVSS base 7.5
Public PoC / Exploit
No public PoC/exploit references indexed yet. Newly-disclosed CVEs often have none — exploit publication lags disclosure.
References3