News KrakenD 3.0 Is Here: AI Router, Semantic Cache, and On-the-Fly Stream Manipulation News KrakenD CE 3.0.2, EE 3.0.2 and EE 2.13.12 Update Released News KrakenD CE 3.0.1, EE 3.0.1 and EE 2.13.11 Update Released News KrakenD Partners with CGK Solutions to Secure API Integration in Italy

CVE-2026-100352 CVE High · CVSS 7.5 False Positive

kin-openapi: Panic via YAML NaN and Infinity Values in OpenAPI 3.1 Request Validation

This advisory does not affect KrakenD

The panic requires validating an incoming request with openapi3filter.ValidateRequest. KrakenD Enterprise uses kin-openapi only to load and translate OpenAPI documents in the krakend openapi commands and never validates requests against an OpenAPI specification. KrakenD Community does not include kin-openapi.

Addressed through routine dependency maintenance in EE 3.0.2, 2.13.12.

Component

kin-openapi (openapi3filter)

Disclosed

Oct 20, 2026

CVSS Score

7.5

Description

Before kin-openapi 0.148.0, the OpenAPI 3.1 validation path passes YAML NaN and infinity values to santhosh-tekuri/jsonschema without applying the library’s finite number guards. An unauthenticated client sending an application/yaml body containing .nan, .inf, or -.inf to an operation with a numeric constraint makes the dependency dereference a nil big.Rat during ValidateRequest and panic.

References

View CVE-2026-100352 on NVD View CVE-2026-100352 on GitHub Advisory Database

Stay up to date with KrakenD releases and important updates