Openapi

Published on
August 28, 2026
Three High-Severity CVEs in kin-openapi, the OpenAPI Library Behind Many Go APIs
klue case-study vulnerability-research denial-of-service dos go golang openapi kin-openapi api-security autonomous-security appsec
We asked KLUE, our AI security agent, to review kin-openapi, a library that a large share of Go web APIs use to read and check incoming requests. It found three separate bugs that each let anyone crash the service with a single request. The pattern behind all three is the same: the library already had the right safety check, it was just missing on one of the paths that needed it. All three were reported, accepted, assigned CVEs (CVE-2026-100352, CVE-2026-100353, CVE-2026-100354), rated High, and fixed by the maintainers.

Three High-Severity CVEs in kin-openapi, the OpenAPI Library Behind Many Go APIs