CVE-2026-100349 kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.146.0, openapi3filter.ValidateResponse passes a nil response header schema to decodeValue when an OpenAPI document declares the header with content instead of schema. The document passes validation, but every response validation f...