{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/kin-openapi--0.145.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:kin-openapi:kin-openapi:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-100349"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["kin-openapi (\u003c= 0.145.0)"],"_cs_severities":["medium"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eA nil-pointer dereference vulnerability exists in \u003ccode\u003egithub.com/getkin/kin-openapi\u003c/code\u003e (versions \u0026lt;= v0.145.0) within the \u003ccode\u003eValidateResponse\u003c/code\u003e function. When an OpenAPI specification defines a response header using the \u003ccode\u003econtent\u003c/code\u003e field without an explicit \u003ccode\u003eschema\u003c/code\u003e, the library attempts to dereference a nil pointer during the validation process.\u003c/p\u003e\n\u003cp\u003eThis issue is significant because \u003ccode\u003edoc.Validate()\u003c/code\u003e incorrectly marks such specifications as valid, allowing them to be loaded into memory. Once an application receives a request that exercises a route associated with the malformed header, the process triggers a runtime panic and terminates. Because the crash occurs on every call to the affected route, this results in an effective denial-of-service (DoS) condition. The vulnerability is triggered automatically during validation logic and does not require a complex malicious payload, only a specification that utilizes the \u003ccode\u003econtent\u003c/code\u003e keyword for response headers.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability results in a persistent DoS condition for any service utilizing \u003ccode\u003ekin-openapi\u003c/code\u003e to validate responses against an OpenAPI specification containing \u003ccode\u003econtent\u003c/code\u003e-typed response headers. Any traffic directed to the affected route will cause the underlying Go service to panic and crash. While individual services may recover upon restart, the crash is deterministic and will recur immediately upon the next request to that route, necessitating the removal or modification of the OpenAPI specification to restore availability.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePrioritize updating \u003ccode\u003egithub.com/getkin/kin-openapi\u003c/code\u003e to a version released after v0.145.0 that includes the nil-pointer guard.\u003c/li\u003e\n\u003cli\u003eIf immediate patching is not possible, identify and manually modify OpenAPI specifications to use \u003ccode\u003eschema\u003c/code\u003e instead of \u003ccode\u003econtent\u003c/code\u003e for all response headers.\u003c/li\u003e\n\u003cli\u003eAs a temporary mitigation, exclude routes containing \u003ccode\u003econtent\u003c/code\u003e-typed response headers from \u003ccode\u003eValidateResponse\u003c/code\u003e processing.\u003c/li\u003e\n\u003cli\u003eImplement automated linter checks in your CI/CD pipeline to flag OpenAPI specifications that declare \u003ccode\u003econtent\u003c/code\u003e within \u003ccode\u003eheaders\u003c/code\u003e objects to prevent deployment of vulnerable configurations.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-16T22:28:43Z","date_published":"2026-10-16T22:28:43Z","id":"https://feed.craftedsignal.io/briefs/2026-10-kin-openapi-nil-pointer/","summary":"A nil-pointer dereference vulnerability (CVE-2026-100349) in kin-openapi causes a process crash when validating response headers that declare 'content' instead of 'schema'.","title":"Denial of Service in kin-openapi via Malformed OpenAPI Specifications","url":"https://feed.craftedsignal.io/briefs/2026-10-kin-openapi-nil-pointer/"}],"language":"en","title":"CraftedSignal Threat Feed - Kin-Openapi (\u003c= 0.145.0)","version":"https://jsonfeed.org/version/1.1"}