kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content

Summary ValidateResponse panics on a nil pointer when a spec declares a response header with content instead of schema. doc.Validate accepts that document, so the crash comes from a spec the library just called valid. Same class as GHSA-jpcw-4wr7-c3vq, which covered the request-parameter case in...

GHSA-74VM-87HJ-R66F kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content

Summary ValidateResponse panics on a nil pointer when a spec declares a response header with content instead of schema. doc.Validate accepts that document, so the crash comes from a spec the library just called valid. Same class as GHSA-jpcw-4wr7-c3vq, which covered the request-parameter case in...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference through the ValidateResponse process when a response header is declared with content instead of schema. An attacker can cause a process crash by sending a request to an affected endpoint, resulting in a nil...

CVE-2026-100349 kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.146.0, openapi3filter.ValidateResponse passes a nil response header schema to decodeValue when an OpenAPI document declares the header with content instead of schema. The document passes validation, but every response validation f...

CVE-2026-100349 kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.146.0, openapi3filter.ValidateResponse passes a nil response header schema to decodeValue when an OpenAPI document declares the header with content instead of schema. The document passes validation, but every response validation f...

CVE-2026-100349 kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.146.0, openapi3filter.ValidateResponse passes a nil response header schema to decodeValue when an OpenAPI document declares the header with content instead of schema. The document passes validation, but every response validation f...

CVE-2026-100349

The kin-openapi Go project is vulnerable to a nil-pointer panic in the openapi3filter.ValidateResponse function in versions prior to 0.146.0 . The root cause occurs when an OpenAPI document declares a response header with content instead of a schema . Although the document passes initial validati...

CVE-2026-97394 kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing items

kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.143.0, openapi3filter accepts OpenAPI 3.1 array schemas without an items keyword and then dereferences the nil Schema.Items value while decoding application/x-www-form-urlencoded or multipart/form-data request bodies,...

CVE-2026-97394 kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing items

kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.143.0, openapi3filter accepts OpenAPI 3.1 array schemas without an items keyword and then dereferences the nil Schema.Items value while decoding application/x-www-form-urlencoded or multipart/form-data request bodies,...