CVE-2026-100349
Deferred Deferred - Pending Action

Response Validation Panic in kin-openapi

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.146.0, openapi3filter.ValidateResponse passes a nil response header schema to decodeValue when an OpenAPI document declares the header with content instead of schema. The document passes validation, but every response validation for the affected operation dereferences the nil schema and panics even when the response does not contain the declared header. Applications that ingest an untrusted specification can expose this as remote availability impact, while applications using only trusted local specifications still crash when the affected operation is exercised. This issue is fixed in version 0.146.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-100349
EUVD
EUVD-2026-102159

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
getkin kin-openapi < 0.146.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the kin-openapi Go library before version 0.146.0. When an OpenAPI document declares a response header with content instead of a schema, the ValidateResponse function passes a nil schema to decodeValue. This causes a nil pointer dereference, leading to a panic during response validation even if the header is missing in the actual response.

Impact Analysis

Applications using untrusted OpenAPI specifications may experience remote availability impact due to crashes. Even with trusted local specs, the affected operation will crash when exercised, causing service disruption. The panic occurs regardless of whether the declared header exists in the response.

Mitigation Strategies
  • Upgrade kin-openapi to version 0.146.0 or later to address the nil pointer dereference issue in ValidateResponse.
  • If upgrading is not immediately possible, add a schema to any response headers declared with content instead of schema in your OpenAPI specifications.
  • Consider skipping ValidateResponse for affected operations as a temporary workaround until the library is updated.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100349. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart