Is CVE-2026-100349 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-100349 being exploited in the wild.

How severe is CVE-2026-100349?

High severity, with a CVSS score of 4, published 15 October 2026.

Which products and versions are affected?

Getkin Kin-Openapi before 0.146.0; github.com/getkin/kin-openapi (Go) <= 0.145.0, SEMVER:introduced=0,fixed=0.146.0.

Is there a fix for CVE-2026-100349?

Yes. github.com/getkin/kin-openapi (Go): upgrade to 0.146.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-100349 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-100349?

Check whether you run Getkin Kin-Openapi or github.com/getkin/kin-openapi (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100349: kin-openapi nil pointer dereference in response validation

Q: Is there a fix for CVE-2026-100349?

Yes. github.com/getkin/kin-openapi (Go): upgrade to 0.146.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-100349 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-100349?

Check whether you run Getkin Kin-Openapi or github.com/getkin/kin-openapi (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100349 · Severity: high · CVSS 4 · Published 2026-10-15

kin-openapi is a Go library for processing OpenAPI specifications. When an untrusted OpenAPI document declares response headers using content instead of schema, the library crashes during response validation, causing service unavailability. Trusted specifications still crash when the affected operation is called.

Technologies: Getkin Kin-Openapi, github.com/getkin/kin-openapi (Go). Vendors: Getkin, Go.

Quick answers

Is CVE-2026-100349 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-100349 being exploited in the wild.
How severe is CVE-2026-100349?: High severity, with a CVSS score of 4, published 15 October 2026.
Which products and versions are affected?: Getkin Kin-Openapi before 0.146.0; github.com/getkin/kin-openapi (Go) <= 0.145.0, SEMVER:introduced=0,fixed=0.146.0.
Is there a fix for CVE-2026-100349?: Yes. github.com/getkin/kin-openapi (Go): upgrade to 0.146.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-100349 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-100349?: Check whether you run Getkin Kin-Openapi or github.com/getkin/kin-openapi (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/getkin/kin-openapi (Go): upgrade to 0.146.0 or later
```
go get github.com/getkin/kin-openapi@v0.146.0
```

Technical details

The openapi3filter.ValidateResponse function passes a nil response header schema to decodeValue when an OpenAPI document uses content instead of schema for header declaration. The document itself passes validation, but any subsequent response validation triggers a nil pointer dereference panic. Attack vector requires either ingesting an untrusted OpenAPI specification or exercising an affected operation with a trusted local spec.

Affected products

getkin kin-openapi before 0.146.0

Identifiers

CVE-2026-100349
GHSA-74vm-87hj-r66f
GO-2026-6804

Timeline

2026-10-15: disclosed
2026-08-03: patched: Version 0.146.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.