[Git][security-tracker-team/security-tracker][master] new golang-github-getkin-kin-openapi issues

[Moritz Muehlenhoff (@jmm)]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
1680f1c0 by Moritz Muehlenhoff at 2026-10-16T13:55:46+02:00
new golang-github-getkin-kin-openapi issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -1244,21 +1244,37 @@ CVE-2026-101287 (Authentication bypass vulnerability in Stela, versions prior to
 CVE-2026-100409 (OpenNext Cloudflare is an open Next.js adapter for Cloudflare. From 0. ...)
 	NOT-FOR-US: Next.js
 CVE-2026-100354 (kin-openapi is a Go project for handling OpenAPI files. Prior to 0.149 ...)
-	TODO: check
+	- golang-github-getkin-kin-openapi <not-affected> (Only affects 0.140 and later)
+	NOTE: https://github.com/getkin/kin-openapi/security/advisories/GHSA-g8cf-rcjf-c8cf
+	NOTE: https://github.com/getkin/kin-openapi/commit/9245cef66c840e27a08409a8a5cd0ee930c5bcff (v0.149.0)
 CVE-2026-100353 (kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 u ...)
-	TODO: check
+	- golang-github-getkin-kin-openapi <not-affected> (Only affects 0.136 and later)
+	NOTE: https://github.com/getkin/kin-openapi/security/advisories/GHSA-vrcc-3ch7-hppw
+	NOTE: https://github.com/getkin/kin-openapi/commit/9814d1f2b212f3508bf52296aa9e248b2122a5a9 (v0.149.0)
 CVE-2026-100352 (kin-openapi is a Go project for handling OpenAPI files. Prior to 0.148 ...)
-	TODO: check
+	- golang-github-getkin-kin-openapi <not-affected> (Only affects 0.144 and later)
+	NOTE: https://github.com/getkin/kin-openapi/security/advisories/GHSA-rj39-cv6w-8wv7
+	NOTE: https://github.com/getkin/kin-openapi/commit/4487f198ab8be0c37d6ca72c54f5dca4dc25270e (v0.148.0)
 CVE-2026-100351 (kin-openapi is a Go project for handling OpenAPI files. From 0.144.0 u ...)
-	TODO: check
+	- golang-github-getkin-kin-openapi <not-affected> (Only affects 0.144 and later)
+	NOTE: https://github.com/getkin/kin-openapi/security/advisories/GHSA-23vg-4cjm-66q5
+	NOTE: https://github.com/getkin/kin-openapi/commit/eda80e2676e9f577ceed2dd80e64f16083edb041 (v0.147.0)
 CVE-2026-100350 (kin-openapi is a Go project for handling OpenAPI files. From 0.145.0 u ...)
-	TODO: check
+	- golang-github-getkin-kin-openapi <not-affected> (Only affects 0.145 and later)
+	NOTE: https://github.com/getkin/kin-openapi/security/advisories/GHSA-h4r5-mxv5-8mjc
+	NOTE: https://github.com/getkin/kin-openapi/commit/d090e36b2f1c42c898ba2a687a8f6e25f5ca727f (v0.146.0)
 CVE-2026-100349 (kin-openapi is a Go project for handling OpenAPI files. Prior to 0.146 ...)
-	TODO: check
+	- golang-github-getkin-kin-openapi <unfixed>
+	NOTE: https://github.com/getkin/kin-openapi/security/advisories/GHSA-74vm-87hj-r66f
+	NOTE: https://github.com/getkin/kin-openapi/commit/f5441d67f855ed34d975b3b85665764644ab1459 (v0.146.0)
 CVE-2026-100348 (kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145 ...)
-	TODO: check
+	- golang-github-getkin-kin-openapi <unfixed>
+	NOTE: https://github.com/getkin/kin-openapi/security/advisories/GHSA-mh7x-f8wq-4jhx
+	NOTE: https://github.com/getkin/kin-openapi/commit/88aa64c7cbd03ecadbb419c473bdcaa8b0124c6b (v0.145.0)
 CVE-2026-100347 (kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145 ...)
-	TODO: check
+	- golang-github-getkin-kin-openapi <unfixed>
+	NOTE: https://github.com/getkin/kin-openapi/security/advisories/GHSA-fh4f-47mf-f2gj
+	NOTE: https://github.com/getkin/kin-openapi/commit/f1a5b523b82868d2d9be2e116b4e942892be72c3 (v0.145.0)
 CVE-2025-68404 (A time-of-check time-of-use (toctou) race condition vulnerability has  ...)
 	NOT-FOR-US: QNAP
 CVE-2025-68403 (An external control of system or configuration setting vulnerability h ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/1680f1c05eb88ad06cb2c0a21b858071891b74bd

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/1680f1c05eb88ad06cb2c0a21b858071891b74bd
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261016/074bcb75/attachment.htm>