CVE-2026-100349
8.2HighPublished 15 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on availability
- Weakness
- CWE-476
Impact
Remote or local callers can crash your service via an unhandled panic during response validation. Any request exercising an operation whose OpenAPI spec defines response headers with 'content' instead of 'schema' triggers the crash.
Root cause
openapi3filter.ValidateResponse passes a nil response header schema to decodeValue when a header uses 'content' rather than 'schema', causing a nil-pointer dereference panic.
Affected systems
kin-openapi prior to 0.146.0
CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Upgrade kin-openapi to 0.146.0 or later. If updating immediately is not possible, rewrite OpenAPI specs to declare response headers using 'schema' instead of 'content'.
$ go get github.com/getkin/kin-openapi@v0.146.0 && go mod tidyAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.146.0, openapi3filter.ValidateResponse passes a nil response header schema to decodeValue when an OpenAPI document declares the header with content instead of schema. The document passes validation, but every response validation for the affected operation dereferences the nil schema and panics even when the response does not contain the declared header. Applications that ingest an untrusted specification can expose this as remote availability impact, while applications using only trusted local specifications still crash when the affected operation is exercised. This issue is fixed in version 0.146.0.