CVE-2026-100349: kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content

October 16, 2026

ValidateResponse panics on a nil pointer when a spec declares a response header with content instead of schema. doc.Validate() accepts that document, so the crash comes from a spec the library just called valid.

Same class as GHSA-jpcw-4wr7-c3vq, which covered the request-parameter case in v0.144.0; this is the response-header path.

Affects github.com/getkin/kin-openapi <= v0.145.0. Reproduced on master 947498e5a6bd, Go 1.26.

References

github.com/advisories/GHSA-74vm-87hj-r66f
github.com/getkin/kin-openapi/commit/f5441d67f855ed34d975b3b85665764644ab1459
github.com/getkin/kin-openapi/releases/tag/v0.146.0
github.com/getkin/kin-openapi/security/advisories/GHSA-74vm-87hj-r66f
nvd.nist.gov/vuln/detail/CVE-2026-100349

Code Behaviors & Features

Detect and mitigate CVE-2026-100349 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →