Homepage

NULL Pointer Dereference The advisory has been revoked - it doesn't affect any version of package go-fdo-server  (opens in a new tab)

Threat Intelligence

EPSS
0.43% (36th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL10-GOFDOSERVER-20989726
  • published16 Oct 2026
  • disclosed15 Oct 2026
Report a new vulnerability Found a mistake?

Introduced: 15 Oct 2026

NewCVE-2026-100352  (opens in a new tab)
CWE-476  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream go-fdo-server package and not the go-fdo-server package as distributed by RHEL.

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.148.0, the OpenAPI 3.1 validation path passes YAML NaN and infinity numeric values to santhosh-tekuri/jsonschema v6.0.2 without applying kin-openapi's existing finite-number guards. A remote unauthenticated client can send an application/yaml or application/x-yaml request body containing .nan, .inf, or -.inf to an operation with a numeric constraint, causing the dependency to create and dereference a nil big.Rat during ValidateRequest. Standard net/http servers recover the panic per connection, while other hosts or application goroutines may terminate the process. This issue is fixed in version 0.148.0.