Denial of Service in kin-openapi via Malformed OpenAPI Specifications

A nil-pointer dereference vulnerability exists in github.com/getkin/kin-openapi (versions <= v0.145.0) within the ValidateResponse function. When an OpenAPI specification defines a response header using the content field without an explicit schema, the library attempts to dereference a nil pointer during the validation process.

This issue is significant because doc.Validate() incorrectly marks such specifications as valid, allowing them to be loaded into memory. Once an application receives a request that exercises a route associated with the malformed header, the process triggers a runtime panic and terminates. Because the crash occurs on every call to the affected route, this results in an effective denial-of-service (DoS) condition. The vulnerability is triggered automatically during validation logic and does not require a complex malicious payload, only a specification that utilizes the content keyword for response headers.

Impact

The vulnerability results in a persistent DoS condition for any service utilizing kin-openapi to validate responses against an OpenAPI specification containing content-typed response headers. Any traffic directed to the affected route will cause the underlying Go service to panic and crash. While individual services may recover upon restart, the crash is deterministic and will recur immediately upon the next request to that route, necessitating the removal or modification of the OpenAPI specification to restore availability.

Recommendation

• Prioritize updating github.com/getkin/kin-openapi to a version released after v0.145.0 that includes the nil-pointer guard.
• If immediate patching is not possible, identify and manually modify OpenAPI specifications to use schema instead of content for all response headers.
• As a temporary mitigation, exclude routes containing content-typed response headers from ValidateResponse processing.
• Implement automated linter checks in your CI/CD pipeline to flag OpenAPI specifications that declare content within headers objects to prevent deployment of vulnerable configurations.