kin-openapi openapi3filter: Nil pointer dereference in response validation
Summary
The Go library kin-openapi, used to handle OpenAPI specifications, crashes when response validation runs for an operation whose response header is declared with "content" instead of "schema". The specification still passes validation, and the panic occurs on every response validation for that operation, even when the response does not contain the header. An attacker who can supply an untrusted specification can cause a denial of service in an application that loads it, and applications using trusted specifications still crash when the affected operation is exercised.
Affected
- kin-openapi versions before 0.146.0 (affected < 0.146.0)
Fixed in
- Upgrade to kin-openapi v0.146.0 or later
Workaround
- Do not load untrusted OpenAPI documents into the loader or validator.
- Check whether your specifications declare response headers with "content" and whether ValidateResponse runs on those operations.
- No vendor-published configuration workaround is known.
Exploitation
- No exploitation in the wild is known.
- CISA SSVC: exploitation none, automatable no, technical impact partial.
- The public advisory contains reproduction details; no separate public exploit for a real service was found.
Our recommendation
- Identify Go applications and tools that use kin-openapi, including indirect dependencies, for example via go.mod files or binaries.
- Upgrade kin-openapi to v0.146.0 or later and rebuild affected applications.
- Where specifications come from external sources, validate them before use and restrict them to trusted inputs until the upgrade is done.
- Monitor service availability for crashes in validating services.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-74vm-87hj-r66f github.com
- GitHub Advisory Database GHSA-74vm-87hj-r66f github.com
- kin-openapi release v0.146.0 github.com
- kin-openapi fix commit f5441d6 github.com
- OSV GHSA-74vm-87hj-r66f osv.dev
- GitLab Advisory Database CVE-2026-100349 advisories.gitlab.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 15:58.
Original description (NVD)
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.146.0, openapi3filter.ValidateResponse passes a nil response header schema to decodeValue when an OpenAPI document declares the header with content instead of schema. The document passes validation, but every response validation for the affected operation dereferences the nil schema and panics even when the response does not contain the declared header. Applications that ingest an untrusted specification can expose this as remote availability impact, while applications using only trusted local specifications still crash when the affected operation is exercised. This issue is fixed in version 0.146.0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.