CVE-2026-100349 in kin-openapi
Summary
by MITRE • 10/15/2026
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.146.0, openapi3filter.ValidateResponse passes a nil response header schema to decodeValue when an OpenAPI document declares the header with content instead of schema. The document passes validation, but every response validation for the affected operation dereferences the nil schema and panics even when the response does not contain the declared header. Applications that ingest an untrusted specification can expose this as remote availability impact, while applications using only trusted local specifications still crash when the affected operation is exercised. This issue is fixed in version 0.146.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/15/2026
The kin-openapi library serves as a critical component for Go-based applications that need to parse and validate OpenAPI documents, which define RESTful API interfaces. A significant flaw exists within the response validation logic of this library prior to version 0.146.0, specifically in the openapi3filter.ValidateResponse function. The vulnerability arises from an improper handling of nil pointers when processing header definitions that utilize a content descriptor rather than a direct schema definition. In OpenAPI specifications, headers can be defined either by specifying their data type directly via a schema or by referencing a media type with its own encoding and schema structure through the content field. When a specification declares a response header using the content approach, the kin-openapi library fails to correctly resolve the underlying schema object during validation.
This technical flaw results in the ValidateResponse function passing a nil pointer for the response header schema to the internal decodeValue helper method. The OpenAPI document itself remains syntactically valid and passes initial structural validation checks because the specification format allows for such definitions without immediate error. However, the runtime execution of response validation logic triggers a critical failure point. When an application processes an HTTP response that matches the affected operation, it attempts to validate the headers against their declared schemas. Because the schema reference is nil due to the aforementioned parsing oversight, any attempt to dereference this pointer leads to a panic condition in Go. This crash occurs regardless of whether the actual HTTP response includes the specific header or not, indicating that the vulnerability is triggered by the mere invocation of validation logic for operations with these specific header definitions rather than by malicious input data alone.
The operational impact of this vulnerability centers on service availability and system stability. For applications that ingest untrusted OpenAPI specifications from external sources, such as third-party API providers or user-uploaded configuration files, this flaw presents a remote availability risk. An attacker who can influence the specification used for validation could potentially cause the application to crash repeatedly by triggering operations associated with vulnerable header definitions. Even in environments where only trusted local specifications are utilized, the reliability of the service is compromised because any legitimate request targeting an operation with these specific header configurations will result in a runtime panic and subsequent application termination. This undermines the robustness of API gateways or microservices that rely on kin-openapi for strict contract enforcement during inbound traffic processing.
From a classification perspective, this issue aligns with CWE-476, which denotes a nil pointer dereference vulnerability. The attack vector is primarily associated with the ATT&CK technique T1529, System Shutdown/Reboot, as the resulting panic effectively terminates the application process, denying service to legitimate users. While it does not directly lead to code execution or data exfiltration in its current form, the denial of service capability makes it a significant concern for production systems where uptime is critical. The vulnerability highlights the importance of defensive programming practices when handling potentially incomplete or malformed schema references within parsing libraries.
To mitigate this risk, organizations utilizing kin-openapi must upgrade to version 0.146.0 or later, which contains the necessary code changes to handle nil schemas gracefully during response validation. For applications that cannot immediately update their dependencies, implementing a custom panic recovery mechanism using Go's defer and recover functions can provide temporary resilience against crashes caused by this specific flaw. Additionally, validating OpenAPI specifications with stricter linting tools before deployment may help identify problematic header definitions early in the development lifecycle. Ensuring that all third-party API contracts are thoroughly tested within staging environments prior to production integration is also recommended to detect such runtime failures before they impact end users.