# kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path

OAS 3.1 validation path in kin-openapi skips NaN/Inf guards, so a YAML body of `.nan`/`.inf` panics jsonschema/v6 via nil *big.Rat dereference.

- Payout: Research
- Severity: high
- Program: kin-openapi
- Found by: eros938, hash3liZer
- Disclosed: 2026-10-15
- CVE: CVE-2026-100352
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-rj39-cv6w-8wv7
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-rj39-cv6w-8wv7
- Tags: area:web domain:oss domain:web impact:dos kind:research platform:ghsa sev:high tech:go technique:incomplete-fix technique:source-review vuln:dos

**Target:** Go OpenAPI request-body validator (openapi3filter) parsing application/yaml bodies
**Root cause:** `useJSONSchema2020` hands values to santhosh-tekuri/jsonschema/v6 without the NaN/Inf guard present in `visitJSON`; jsonschema v6.0.2's `numValidate` builds a `*big.Rat` via `SetString(fmt.Sprintf("%v", v))`, which returns nil for NaN/Inf, then dereferences it in `Rat.Cmp`.
**Steps:**
1. Deploy an OAS 3.1 spec with a YAML request body schema declaring `type: number` and a numeric constraint such as `minimum: 0`.
2. Send `POST /test` with `Content-Type: application/yaml` and body `.nan` (also `.inf`, `-.inf`).
3. YamlBodyDecoder decodes the token to `math.NaN()`/`math.Inf(±1)`, which reaches `useJSONSchema2020` unguarded.
4. jsonschema/v6 v6.0.2 `numValidate` calls `big.Rat.SetString(fmt.Sprintf("%v", v))`, gets nil, and panics in `math/big.(*Rat).Cmp`.
5. Verify fix by upgrading only to `jsonschema/v6@v6.0.3`: payloads return a clean validation error instead of panicking.
**How found:** Noticed the library explicitly rejects NaN/Inf in its own `visitJSON` visitor (ErrSchemaInputNaN/Inf) but the OAS 3.1 dispatch to jsonschema/v6 omits the same check; traced the value into jsonschema v6.0.2's `numValidate` and confirmed the nil `*big.Rat` dereference with a panic stack trace, then validated the path by patching only the transitive dependency.
**Exploitation:** Unauthenticated attacker sends a single crafted YAML request body to any OAS 3.1 endpoint with a numeric constraint. Under net/http the panic is recovered per-connection (client sees EOF, process survives); non-net/http hosts or validation in app-spawned goroutines crash the whole process. Sustained flooding degrades availability.
**Insight:** When a library has two validation backends (legacy visitor vs. delegated JSON-Schema-2020 validator), diff their input-sanitization guards: the delegated path often skips checks the native path enforces. YAML's `.nan`/`.inf` tokens are a cheap way to feed non-finite floats into numeric validators that assume finite JSON numbers.