OpenAPI File Handling Vulnerability in Kin-OpenAPI by Getkin

CVE-2026-100349

What is CVE-2026-100349?

Kin-OpenAPI, a Go project designed for handling OpenAPI files, contains a vulnerability that arises from improper handling of nil response header schemas. Prior to version 0.146.0, the openapi3filter.ValidateResponse function fails to properly validate response headers when they are declared with content rather than schema. This flaw can lead to application crashes even with trusted local specifications, as any execution of the affected operation triggers a panic due to dereferencing a nil schema. It is crucial for users to update to version 0.146.0 or later to mitigate this issue and ensure the stability of their applications.

References