{"metadata": {"vulnerability": "CVE-2026-100353", "count": 36, "kinds": {"milestone": 6, "sighting": 2, "kev": 0, "other": 28}}, "data": [{"timestamp": "2026-09-25T19:19:54.697Z", "date_only": false, "value": "2026-09-25T19:19:54.697Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-100353", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-14T00:21:37Z", "date_only": false, "value": "2026-10-14T00:21:37+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:82637", "record": "RHSA-2026:82637", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-10-14T00:21:37Z", "date_only": false, "value": "2026-10-14T00:21:37+00:00", "kind": "other", "label": "Date", "source": "csaf_redhat \u00b7 RHSA-2026:82637", "record": "RHSA-2026:82637", "field": "vulnerabilities.0.remediations.0.date"}, {"timestamp": "2026-10-14T00:21:37Z", "date_only": false, "value": "2026-10-14T00:21:37+00:00", "kind": "milestone", "label": "Published", "source": "csaf_redhat \u00b7 RHSA-2026:82637", "record": "RHSA-2026:82637", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-10-15T15:29:05.238Z", "date_only": false, "value": "2026-10-15T15:29:05.238000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:82637", "record": "RHSA-2026:82637", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2026-10-15T15:35:43.874Z", "date_only": false, "value": "2026-10-15T15:35:43.874000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:82637", "record": "RHSA-2026:82637", "field": "vulnerabilities.1.release_date"}, {"timestamp": "2026-10-15T15:37:19.077Z", "date_only": false, "value": "2026-10-15T15:37:19.077000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:82637", "record": "RHSA-2026:82637", "field": "vulnerabilities.3.release_date"}, {"timestamp": "2026-10-15T15:45:59.705Z", "date_only": false, "value": "2026-10-15T15:45:59.705582+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:82637", "record": "RHSA-2026:82637", "field": "vulnerabilities.0.discovery_date"}, {"timestamp": "2026-10-15T15:50:37.453Z", "date_only": false, "value": "2026-10-15T15:50:37.453000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:82637", "record": "RHSA-2026:82637", "field": "vulnerabilities.2.release_date"}, {"timestamp": "2026-10-15T15:51:05.132Z", "date_only": false, "value": "2026-10-15T15:51:05.132393+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:82637", "record": "RHSA-2026:82637", "field": "vulnerabilities.1.discovery_date"}, {"timestamp": "2026-10-15T15:52:30.041Z", "date_only": false, "value": "2026-10-15T15:52:30.041000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:82637", "record": "RHSA-2026:82637", "field": "vulnerabilities.4.release_date"}, {"timestamp": "2026-10-15T15:52:40.679Z", "date_only": false, "value": "2026-10-15T15:52:40.679996+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:82637", "record": "RHSA-2026:82637", "field": "vulnerabilities.3.discovery_date"}, {"timestamp": "2026-10-15T15:54:25.834Z", "date_only": false, "value": "2026-10-15T15:54:25.834000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:82637", "record": "RHSA-2026:82637", "field": "vulnerabilities.5.release_date"}, {"timestamp": "2026-10-15T16:01:25.836Z", "date_only": false, "value": "2026-10-15T16:01:25.836287+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:82637", "record": "RHSA-2026:82637", "field": "vulnerabilities.4.discovery_date"}, {"timestamp": "2026-10-15T16:01:52.384Z", "date_only": false, "value": "2026-10-15T16:01:52.384419+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:82637", "record": "RHSA-2026:82637", "field": "vulnerabilities.5.discovery_date"}, {"timestamp": "2026-10-15T16:02:00.566Z", "date_only": false, "value": "2026-10-15T16:02:00.566000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:82637", "record": "RHSA-2026:82637", "field": "vulnerabilities.7.release_date"}, {"timestamp": "2026-10-15T16:02:25.651Z", "date_only": false, "value": "2026-10-15T16:02:25.651913+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:82637", "record": "RHSA-2026:82637", "field": "vulnerabilities.2.discovery_date"}, {"timestamp": "2026-10-15T16:03:50.514Z", "date_only": false, "value": "2026-10-15T16:03:50.514Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-100353", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-15T16:03:50.514Z", "date_only": false, "value": "2026-10-15T16:03:50.514000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:82637", "record": "RHSA-2026:82637", "field": "vulnerabilities.6.release_date"}, {"timestamp": "2026-10-15T16:03:50.514Z", "date_only": false, "value": "2026-10-15T16:03:50.514Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-100353", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-15T16:03:50.514Z", "date_only": false, "value": "2026-10-15T16:03:50.514Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-100353", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-15T16:18:49.434Z", "date_only": false, "value": "2026-10-15T16:18:49.434301Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117445828854669889", "record": "CVE-2026-100353", "field": "creation_timestamp", "uuid": "94312e0d-8f54-40f1-bca5-412a62f77c7b", "content": "CVE-2026-100353 kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.149.0, three openapi3filter decoder paths that were missed by the fix for GHSA-p6wj-qrr4-pgh5 lack a nil-items guard for legal OpenAPI 3.1 array schemas. An unauthenticated remote client can trigger a deterministic nil-pointer panic through an array query parameter, a deepObject query parameter containing an array property, or an application/x-www-form-urlencoded request body whose array property appears inside an allOf, anyOf, or oneOf subschema. The query and composed-body paths reach urlValuesDecoder.parseArray, while the deepObject path reaches buildResObj, and all pass a nil items schema into code that dereferences it. This issue is fixed in version 0.149.0.\nhttps://www.cve.org/CVERecord?id=CVE-2026-100353https://github.com/getkin/kin-openapi/security/advisories/GHSA-vrcc-3ch7-hppwhttps://github.com/getkin/kin-openapi/commit/9814d1f2b212f3508bf52296aa9e248b2122a5a9https://github.com/getkin/kin-openapi/releases/tag/v0.149.0#getkin #kin-openapi#CVE_2026_100353#bot", "url": "https://infosec.exchange/users/cve/statuses/117445828854669889"}, {"timestamp": "2026-10-15T16:21:51.407Z", "date_only": false, "value": "2026-10-15T16:21:51.407667+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:82637", "record": "RHSA-2026:82637", "field": "vulnerabilities.7.discovery_date"}, {"timestamp": "2026-10-15T16:22:12.494Z", "date_only": false, "value": "2026-10-15T16:22:12.494131+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:82637", "record": "RHSA-2026:82637", "field": "vulnerabilities.6.discovery_date"}, {"timestamp": "2026-10-15T17:17:07Z", "date_only": false, "value": "2026-10-15T17:17:07Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-VRCC-3CH7-HPPW", "record": "GHSA-VRCC-3CH7-HPPW", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-15T17:17:07.627Z", "date_only": false, "value": "2026-10-15T17:17:07.627", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-100353", "record": "FKIE_CVE-2026-100353", "field": "published"}, {"timestamp": "2026-10-15T17:17:07.747Z", "date_only": false, "value": "2026-10-15T17:17:07.747", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-100353", "record": "FKIE_CVE-2026-100353", "field": "lastModified"}, {"timestamp": "2026-10-15T20:20:47Z", "date_only": false, "value": "2026-10-15T20:20:47Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-VRCC-3CH7-HPPW", "record": "GHSA-VRCC-3CH7-HPPW", "field": "published"}, {"timestamp": "2026-10-15T20:20:47Z", "date_only": false, "value": "2026-10-15T20:20:47Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-VRCC-3CH7-HPPW", "record": "GHSA-VRCC-3CH7-HPPW", "field": "modified"}, {"timestamp": "2026-10-15T21:29:59.291Z", "date_only": false, "value": "2026-10-15T21:29:59.291842Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mxwyzybpuy2u", "record": "CVE-2026-100353", "field": "creation_timestamp", "uuid": "3493a8fe-87b2-4361-8dfc-89822aab4b2a", "content": "kin-openapi 0.136.0\u304b\u30890.149.0\u306b\u304a\u3044\u3066\u3001OpenAPI 3.1\u914d\u5217\u30b9\u30ad\u30fc\u30de\u306enil-items\u30ac\u30fc\u30c9\u304c\u6b20\u5982\u3002\u975e\u8a8d\u8a3c\u306e\u30ea\u30e2\u30fc\u30c8\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u304c\u3001\u914d\u5217\u30af\u30a8\u30ea\u30d1\u30e9\u30e1\u30fc\u30bf\u306a\u3069\u3092\u4ecb\u3057\u3066\u2026\nCVE-2026-100353 CVSS 7.5 | HIGH", "url": "https://bsky.app/profile/postac001.bsky.social/post/3mxwyzybpuy2u"}, {"timestamp": "2026-10-16T00:00:00Z", "date_only": false, "value": "2026-10-16T00:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-100353", "record": "UBUNTU-CVE-2026-100353", "field": "published"}, {"timestamp": "2026-10-16T00:00:00Z", "date_only": false, "value": "2026-10-16T00:00:00Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-100353", "record": "UBUNTU-CVE-2026-100353", "field": "modified"}, {"timestamp": "2026-10-16T07:47:11Z", "date_only": false, "value": "2026-10-16T07:47:11+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:82637", "record": "RHSA-2026:82637", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-10-17T03:51:51Z", "date_only": false, "value": "2026-10-17T03:51:51+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:82637", "record": "RHSA-2026:82637", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2026-10-17T03:51:51Z", "date_only": false, "value": "2026-10-17T03:51:51+00:00", "kind": "other", "label": "Document generated", "source": "csaf_redhat \u00b7 RHSA-2026:82637", "record": "RHSA-2026:82637", "field": "document.tracking.generator.date"}, {"timestamp": "2026-10-17T03:51:51Z", "date_only": false, "value": "2026-10-17T03:51:51+00:00", "kind": "other", "label": "Updated", "source": "csaf_redhat \u00b7 RHSA-2026:82637", "record": "RHSA-2026:82637", "field": "document.tracking.current_release_date"}]}