CVE-2026-100349 Details
Description
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.146.0, openapi3filter.ValidateResponse passes a nil response header schema to decodeValue when an OpenAPI document declares the header with content instead of schema. The document passes validation, but every response validation for the affected operation dereferences the nil schema and panics even when the response does not contain the declared header. Applications that ingest an untrusted specification can expose this as remote availability impact, while applications using only trusted local specifications still crash when the affected operation is exercised. This issue is fixed in version 0.146.0.
A nil-pointer dereference vulnerability has been identified in the kin-openapi Go library, specifically in versions prior to 0.146.0. The issue arises in the response validation process when an OpenAPI document specifies a response header with 'content' instead of 'schema'. While the OpenAPI document passes validation, the response validation for the affected operation dereferences the nil schema, leading to a panic. This vulnerability can cause a process crash, particularly when handling untrusted OpenAPI specifications, although it also affects trusted local specifications under certain conditions.
Users can update to kin-openapi version 0.146.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 15, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/getkin/kin-openapi/commit/f5441d67f855ed34d975b3b85665764644ab1459 | [email protected] | Source CodeVendor |
| https://github.com/getkin/kin-openapi/releases/tag/v0.146.0 | [email protected] | Release NotesVendor |
| https://github.com/getkin/kin-openapi/security/advisories/GHSA-74vm-87hj-r66f | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-476 | NULL Pointer Dereference | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| kin-openapi | <= 0.145.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 16, 2026 | CVE Modified | CISA-ADP |
| Oct 15, 2026 | New CVE Received | [email protected] |