CVE-2026-100352
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.148.0, the OpenAPI 3.1 validation path passes YAML NaN and infinity numer
CVSS
7.5
Alto
EPSS
0.4%
p36
KEV
—
Exploit Today
11
0-100
Publicado: 15 oct 2026 · Última mod.: 20 oct 2026 · CWE-754
0.4%EPSS · 30 días0.4%
2026-10-162026-10-20
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.148.0, the OpenAPI 3.1 validation path passes YAML NaN and infinity numeric values to santhosh-tekuri/jsonschema v6.0.2 without applying kin-openapi's existing finite-number guards. A remote unauthenticated client can send an application/yaml or application/x-yaml request body containing .nan, .inf, or -.inf to an operation with a numeric constraint, causing the dependency to create and dereference a nil big.Rat during ValidateRequest. Standard net/http servers recover the panic per connection, while other hosts or application goroutines may terminate the process. This issue is fixed in version 0.148.0.
- github.comhttps://github.com/getkin/kin-openapi/commit/4487f198ab8be0c37d6ca72c54f5dca4dc25270e
- github.comhttps://github.com/getkin/kin-openapi/releases/tag/v0.148.0
- github.comhttps://github.com/getkin/kin-openapi/security/advisories/GHSA-rj39-cv6w-8wv7
- github.comhttps://github.com/getkin/kin-openapi/security/advisories/GHSA-rj39-cv6w-8wv7
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-113380—20.0%
——6In the RingRTC library before 2.72.0 for Signal, a peer that saturates a call's FSM queue can interfere with the ability of a local hangup to tear the call (with its audio and perhaps also video track) down.18hCVE-2026-487417.5 ALT36.1%
——11libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, alternateArrayAccess in src/mms/iso_mms/server/mms_read_service.c does not validate an alternate-access sub-array range when numberOfElements is greater than zero. An out-of-range MmsValue_getElement call returns NULL, and the sub-array branch passes that value to MmsValue_isDeletable, causing a NULL pointer dereference. A remote MMS Read request can therefore crash servers whose data models contain arrays, while the single-element error path handles the same invalid index safely. This issue is fixed in version 1.6.2.11hCVE-2026-1098557.5 ALT19.1%
——6undici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSocket client, which is enabled by default when HTTP/2 is allowed, mishandles a failed WebSocket handshake over HTTP/2: the request is already marked completed, so the abort becomes a no-op and the underlying HTTP/2 stream is left open with no error listener. When a malicious server then destroys the connection, the orphaned stream emits an unhandled error and the Node.js process exits. A remote, unauthenticated server can therefore crash any client that opens a WebSocket to it over HTTP/2, resulting in a denial of service. The issue is fixed in undici 8.11.2, and users should upgrade to 8.11.2 or later. As a workaround, set allowH2 to false to disable HTTP/2 for WebSocket connections, or avoid opening WebSocket connections to untrusted servers.2dCVE-2026-0319—19.1%
——6An improper input handling vulnerability in the GlobalProtect™ gateway of Palo Alto Networks PAN-OS software enables an authenticated user to establish a GlobalProtect session using the identity of another user.
Cloud NGFW and Panorama are not affected by this vulnerability.6dCVE-2026-0318—23.2%
——7A stack-based buffer overflow vulnerability in the log processing functionality of Palo Alto Networks PAN-OS® software on Panorama enables an attacker to cause a denial of service (DoS) condition. Repeated attempts to trigger this condition result in the Panorama entering maintenance mode.
Cloud NGFW, Prisma® Access, and standalone PAN-OS firewalls are not affected by this vulnerability.6dCVE-2026-0317—21.2%
——6A denial of service vulnerability in Palo Alto Networks PAN-OS software enables an authenticated user with a read-only administrator role to cause a denial of service (DoS) condition by sending a specially crafted API request.
The security risk posed by this issue is significantly minimized by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .
Cloud NGFW, Panorama, and Prisma® Access are not affected by this vulnerability.6d