# CVE-2026-100349: kin-openapi nil pointer dereference in response validation

Source: https://junglewise.ai/threats/cve-2026-100349-kin-openapi-is-a-go-project-for-handling-openapi-files-prior-to  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-15. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-100349 · Severity: high · CVSS 4 · Published 2026-10-15

kin-openapi is a Go library for processing OpenAPI specifications. When an untrusted OpenAPI document declares response headers using content instead of schema, the library crashes during response validation, causing service unavailability. Trusted specifications still crash when the affected operation is called.

Technologies: [Getkin Kin-Openapi](https://junglewise.ai/threats/technologies/kin-openapi), [github.com/getkin/kin-openapi (Go)](https://junglewise.ai/threats/technologies/github-com-getkin-kin-openapi). Vendors: [Getkin](https://junglewise.ai/threats/vendors/getkin), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-100349 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-100349 being exploited in the wild.

**How severe is CVE-2026-100349?** High severity, with a CVSS score of 4, published 15 October 2026.

**Which products and versions are affected?** Getkin Kin-Openapi before 0.146.0; github.com/getkin/kin-openapi (Go) <= 0.145.0, SEMVER:introduced=0,fixed=0.146.0.

**Is there a fix for CVE-2026-100349?** Yes. github.com/getkin/kin-openapi (Go): upgrade to 0.146.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-100349 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-100349?** Check whether you run Getkin Kin-Openapi or github.com/getkin/kin-openapi (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/getkin/kin-openapi (Go): upgrade to 0.146.0 or later

  ```sh
  go get github.com/getkin/kin-openapi@v0.146.0
  ```


## Technical details

The openapi3filter.ValidateResponse function passes a nil response header schema to decodeValue when an OpenAPI document uses content instead of schema for header declaration. The document itself passes validation, but any subsequent response validation triggers a nil pointer dereference panic. Attack vector requires either ingesting an untrusted OpenAPI specification or exercising an affected operation with a trusted local spec.

## Affected products

- getkin kin-openapi before 0.146.0

## Identifiers

- CVE-2026-100349
- GHSA-74vm-87hj-r66f
- GO-2026-6804

## Timeline

- 2026-10-15: disclosed
- 2026-08-03: patched: Version 0.146.0 released

## References

- [https://github.com/getkin/kin-openapi/commit/f5441d67f855ed34d975b3b85665764644ab1459](https://github.com/getkin/kin-openapi/commit/f5441d67f855ed34d975b3b85665764644ab1459)
- [https://github.com/getkin/kin-openapi/releases/tag/v0.146.0](https://github.com/getkin/kin-openapi/releases/tag/v0.146.0)

## Related threats

- [kin-openapi uncontrolled recursion on circular allOf/anyOf/oneOf schemas](https://junglewise.ai/threats/cve-2026-100354-kin-openapi-uncontrolled-recursion-on-circular-allof-anyof-oneof)
- [kin-openapi SecurityHandler authentication bypass via path encoding](https://junglewise.ai/threats/cve-2026-100351-kin-openapi-validationhandler-security-requirement-bypass-via)
- [kin-openapi deepObject query decoding DoS via repeated regexp compilation](https://junglewise.ai/threats/cve-2026-100350-kin-openapi-deepobject-query-decoding-repeatedly-compiles-an)
- [kin-openapi OpenAPI spec loader nil-pointer panic on self-referential additionalProperties](https://junglewise.ai/threats/cve-2026-100348-kin-openapi-spec-loader-panics-on-a-self-referential)
- [kin-openapi: Unauthenticated denial of service in legacy router](https://junglewise.ai/threats/cve-2026-100347-kin-openapi-unauthenticated-panic-dos-in-openapi3filter-legacy)