Vendor
An incomplete fix for an OpenAPI 3.1 validation flaw allows unauthenticated attackers to trigger process-crashing nil-pointer dereferences in kin-openapi by supplying array schemas without an 'items' keyword.