kin-openapi flaw allows remote crash via malformed API specs

An attacker gains the ability to crash Go-based API services simply by providing a crafted OpenAPI document. They do not need to exploit complex logic or inject code. The weakness relies on how the library handles response headers defined with content types rather than standard schemas. This grants them remote denial-of-service capabilities against applications that validate or ingest these specifications, disrupting availability for legitimate users.

In plain English

The kin-openapi library processes OpenAPI documents to validate API requests and responses. Before version 0.146.0, it contained a flaw in how it checked response headers. If a header was declared using a content type instead of a schema, the library accepted the document as valid. However, when the application later tried to validate an actual response, it attempted to read a non-existent schema value. This caused the program to panic and crash, stopping the service entirely.

The background

This issue is tracked as CVE-2026-100349 and rated high severity with a CVSS score of 8.2. It is classified under CWE-476, which covers null pointer dereferences. The problem occurs in the openapi3filter component. According to the NVD record, the document passes initial validation, but every subsequent response validation for the affected operation triggers the panic. This happens even if the response does not actually contain the declared header, making the crash inevitable for that endpoint.

What changes now

The kin-openapi maintainers have released version 0.146.0 to fix this issue. This update addresses the nil pointer dereference that occurred when processing content-typed response headers. Applications using versions 0.145.0 or earlier remain vulnerable. The GitHub advisory confirms that the patch resolves the crash in the response header path, which was distinct from a previous similar issue in request parameters. Users should upgrade to the fixed version to restore service stability.

The attacker's path

Teams usually encounter this class of vulnerability when external inputs bypass initial checks but fail during deeper processing. In this scenario, the attacker supplies a specification that looks valid at first glance. The system accepts it, but crashes when it tries to use the data. This serves the initial disruption stage of an intrusion, denying service before any data theft occurs. Check whether your systems ingest untrusted API definitions. Verify that validation logic handles missing or null values gracefully. Ensure that errors in parsing do not bring down the entire service.

What to do and how to stay safe

• Identify all services using kin-openapi versions 0.145.0 or earlier in your environment.
• Upgrade affected applications to version 0.146.0 or

Step-by-step guide: Emergency Patching: Correcting Five Common Operational Errors

General security guidance from the RedTeam Log newsroom. It is not confirmed advice from the organisations named in this story.