{"metadata": {"vulnerability": "ghsa-vrcc-3ch7-hppw", "count": 8, "kinds": {"milestone": 3, "sighting": 1, "kev": 0, "other": 4}}, "data": [{"timestamp": "2026-09-25T19:19:54.697Z", "date_only": false, "value": "2026-09-25T19:19:54.697Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5 \u00b7 CVE-2026-100353", "record": "CVE-2026-100353", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-15T16:03:50.514Z", "date_only": false, "value": "2026-10-15T16:03:50.514Z", "kind": "milestone", "label": "Published", "source": "cvelistv5 \u00b7 CVE-2026-100353", "record": "CVE-2026-100353", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-15T16:03:50.514Z", "date_only": false, "value": "2026-10-15T16:03:50.514Z", "kind": "other", "label": "Updated", "source": "cvelistv5 \u00b7 CVE-2026-100353", "record": "CVE-2026-100353", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-15T16:03:50.514Z", "date_only": false, "value": "2026-10-15T16:03:50.514Z", "kind": "other", "label": "Updated", "source": "cvelistv5 \u00b7 CVE-2026-100353 / GitHub_M", "record": "CVE-2026-100353", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-15T16:18:49.506Z", "date_only": false, "value": "2026-10-15T16:18:49.506756Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117445828854669889", "record": "GHSA-vrcc-3ch7-hppw", "field": "creation_timestamp", "uuid": "443788c2-cc69-4f63-adcc-e5cd5a6ee325", "content": "CVE-2026-100353 kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.149.0, three openapi3filter decoder paths that were missed by the fix for GHSA-p6wj-qrr4-pgh5 lack a nil-items guard for legal OpenAPI 3.1 array schemas. An unauthenticated remote client can trigger a deterministic nil-pointer panic through an array query parameter, a deepObject query parameter containing an array property, or an application/x-www-form-urlencoded request body whose array property appears inside an allOf, anyOf, or oneOf subschema. The query and composed-body paths reach urlValuesDecoder.parseArray, while the deepObject path reaches buildResObj, and all pass a nil items schema into code that dereferences it. This issue is fixed in version 0.149.0.\nhttps://www.cve.org/CVERecord?id=CVE-2026-100353https://github.com/getkin/kin-openapi/security/advisories/GHSA-vrcc-3ch7-hppwhttps://github.com/getkin/kin-openapi/commit/9814d1f2b212f3508bf52296aa9e248b2122a5a9https://github.com/getkin/kin-openapi/releases/tag/v0.149.0#getkin #kin-openapi#CVE_2026_100353#bot", "url": "https://infosec.exchange/users/cve/statuses/117445828854669889"}, {"timestamp": "2026-10-15T17:17:07Z", "date_only": false, "value": "2026-10-15T17:17:07Z", "kind": "other", "label": "Nvd published at", "source": "github", "record": "ghsa-vrcc-3ch7-hppw", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-15T20:20:47Z", "date_only": false, "value": "2026-10-15T20:20:47Z", "kind": "milestone", "label": "Published", "source": "github", "record": "ghsa-vrcc-3ch7-hppw", "field": "published"}, {"timestamp": "2026-10-15T20:20:47Z", "date_only": false, "value": "2026-10-15T20:20:47Z", "kind": "other", "label": "Updated", "source": "github", "record": "ghsa-vrcc-3ch7-hppw", "field": "modified"}]}