News KrakenD 3.0 Is Here: AI Router, Semantic Cache, and On-the-Fly Stream Manipulation News KrakenD CE 3.0.2, EE 3.0.2 and EE 2.13.12 Update Released News KrakenD CE 3.0.1, EE 3.0.1 and EE 2.13.11 Update Released News KrakenD Partners with CGK Solutions to Secure API Integration in Italy

CVE-2026-100354 CVE High · CVSS 7.5 False Positive

kin-openapi: Fatal Stack Overflow via Circular allOf, anyOf, or oneOf Schemas

This advisory does not affect KrakenD

The recursion only happens when validating data against a schema. KrakenD Enterprise loads OpenAPI documents in the krakend openapi commands to translate them, but never validates requests, responses, or other values against their schemas, and never imports openapi3filter. KrakenD Community does not include kin-openapi.

Addressed through routine dependency maintenance in EE 3.0.2, 2.13.12.

Component

kin-openapi (openapi3 and openapi3filter)

Disclosed

Oct 20, 2026

CVSS Score

7.5

Description

Before kin-openapi 0.149.0, runtime request, response, and direct schema validation lack cycle detection when an allOf, anyOf, or oneOf chain refers back to an ancestor schema, even though loading and document validation accept the circular reference. A request or response reaching the affected schema causes unbounded recursion in Schema.VisitJSON or openapi3filter.decodeValue. The resulting stack overflow cannot be recovered and terminates the whole process.

References

View CVE-2026-100354 on NVD View CVE-2026-100354 on GitHub Advisory Database

Stay up to date with KrakenD releases and important updates