Key points
- The vulnerability affects versions of kin-openapi prior to 0.146.0 and is tracked as CVE-2026-100349.
- The crash occurs because the library passes a nil schema to a decoder when a header uses content rather than schema.
- The issue is fixed in version 0.146.0, which addresses the nil pointer dereference in response validation.
The kin-openapi library for Go contains a high-severity flaw that causes applications to crash when processing specific OpenAPI documents. According to the National Vulnerability Database, this issue allows remote availability impact if an application ingests untrusted specifications. The crash happens during response validation, specifically when the library attempts to dereference a nil schema pointer. This behavior affects any Go service using the library to validate API responses against documents that declare headers with content instead of schema fields.
By the numbers
- CVSS score 8.2, rated as high severity by the National Vulnerability Database.
- Version 0.146.0 is the first release that resolves the nil pointer panic issue.
- Versions up to and including 0.145.0 are vulnerable to this specific crash condition.
What the figures mean
The CVSS score of 8.2 reflects the high severity of the availability impact caused by this nil pointer dereference. According to GitHub advisory GHSA-74vm-87hj-r66f, the flaw exists in the ValidateResponse function, which processes response headers defined with content blocks. The library accepts these documents as valid during initial checks, but the subsequent validation step fails because it assumes a schema object is present. This mismatch leads to an immediate panic in the Go runtime, effectively crashing the service.
This issue mirrors a previous vulnerability, GHSA-jpcw-4wr7-c3vq, which affected request parameters in version 0.144.0. The current flaw focuses on the response header path, showing a pattern where content-based definitions bypass schema checks. Applications using only trusted local specifications still face crashes when the affected operation is exercised, meaning the risk exists even without external input. The fix in version 0.146.0 addresses this by ensuring the decoder handles nil schema values correctly, preventing the panic from occurring during validation.
What to watch
Security teams should monitor their Go dependencies for updates to kin-openapi, particularly if they use OpenAPI validation for API responses. The vulnerability is triggered by specific document structures, so any change to API specifications that introduces content-based headers could expose the flaw. Analysts should review error logs for panic messages related to nil pointer dereferences in response validation code. Additionally, teams should check if their applications ingest external OpenAPI documents, as this increases the risk of remote exploitation.
Infection and persistence in general
Teams usually encounter this type of vulnerability when integrating third-party libraries that handle external data formats. The malware or malicious code does not persist; instead, the crash disrupts service availability. Analysts examine dependency trees to identify vulnerable versions and check for recent updates. They review application logs for unexpected panics or crashes that correlate with specific API calls. Monitoring for new advisories on similar libraries helps prevent future incidents. Teams should also validate that their testing environments include edge cases for data format variations.
What to do and how to stay safe: kin-openapi
- Update kin-openapi to version 0.146.0 or later to resolve the nil pointer panic vulnerability.
- Review OpenAPI specifications used in your application for headers defined with content instead of schema.
- Monitor application logs for panic messages related to response validation in the kin-openapi library.
- Test your application with edge-case OpenAPI documents to ensure stability after updating the library.
Step-by-step guide: Patch Management Implementation: A Step-by-Step Rollout Plan
General security guidance from the Sandbox Gazette newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-100349?
CVE-2026-100349 is a high-severity vulnerability in the kin-openapi library that causes a nil pointer panic during response validation.
Which versions of kin-openapi are affected?
Versions of kin-openapi prior to 0.146.0 are affected by this vulnerability, including version 0.145.0.
How can I fix this issue?
You can fix this issue by updating kin-openapi to version 0.146.0, which includes the patch for the nil pointer panic.
