{"action":"Upgrade github.com/getkin/kin-openapi to 0.143.0 or later.","affected":[{"fixed":"0.143.0","introduced":"0.136.0"}],"component":"github.com/getkin/kin-openapi","cve_ids":["CVE-2026-97394"],"ecosystem":"Go","exploited":false,"fixed_versions":["0.143.0"],"ghsa_id":"GHSA-p6wj-qrr4-pgh5","id":"tcs_01M5JK9DNYGYNBQGSY0QKZM1VD","modified_at":"2026-10-21T03:11:56.394072112Z","published_at":"2026-10-15T20:14:54Z","references":["https://osv.dev/vulnerability/GHSA-p6wj-qrr4-pgh5","https://github.com/getkin/kin-openapi/security/advisories/GHSA-p6wj-qrr4-pgh5","https://nvd.nist.gov/vuln/detail/CVE-2026-97394","https://github.com/getkin/kin-openapi/commit/30e292371a89ca6d1f91a9553e0aa518b49f838d","https://github.com/getkin/kin-openapi","https://github.com/getkin/kin-openapi/releases/tag/v0.143.0"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-p6wj-qrr4-pgh5","url":"https://osv.dev/vulnerability/GHSA-p6wj-qrr4-pgh5"}],"summary":"kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing items"}