Key points
- CVE-2026-100349 affects kin-openapi versions prior to 0.146.0.
- The issue is a nil pointer dereference rated CVSS 8.2 HIGH.
- A fix is available in version 0.146.0 for Go projects.
The kin-openapi Go library contains a high-severity flaw in all versions released before 0.146.0. This vulnerability, identified as CVE-2026-100349, allows attackers to crash applications that use the library to validate API responses. The issue is fixed in version 0.146.0, which developers should deploy immediately to restore system stability and availability.
In plain English
The kin-openapi library helps Go programs understand OpenAPI specification files. When a program validates an API response, it checks if the data matches the rules in the specification. In older versions of this library, a specific type of header declaration causes the validation code to look for data that does not exist. This missing data reference causes the program to stop working entirely, resulting in a crash.
The background
The National Vulnerability Database rates CVE-2026-100349 as high severity with a CVSS score of 8.2. The flaw stems from CWE-476, a nil pointer dereference. The problem occurs when an OpenAPI document declares a header with content instead of a schema. The document passes initial validation, but subsequent response checks fail because the code tries to use a null value.
What changes now
Developers using kin-openapi must upgrade to version 0.146.0 to resolve this issue. This update corrects how the library handles response validation for headers defined with content. Applications that process untrusted OpenAPI specifications are at risk of remote availability impacts. Even applications using only trusted local files will crash when the affected operation is triggered.
Who needs to act first
Teams should prioritize updating systems that accept OpenAPI specifications from external or untrusted sources, as these face remote availability risks. Inventory all services using kin-openapi to identify exposure levels before rolling out changes. Test the updated library version in a staging environment to ensure compatibility with existing API contracts. Back up current configurations and codebases prior to deployment. Monitor application logs for crash indicators after the update to verify stability.
What to do and how to stay safe: kin-openapi
- Audit your Go projects to identify any usage of kin-openapi versions older than 0.146.0.
- Upgrade to version 0.146.0 or later once you have verified compatibility in a test environment.
- Review OpenAPI specifications for headers defined with content instead of schema to understand potential triggers.
- Monitor application logs for unexpected panics or crashes related to response validation errors.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of kin-openapi are affected by this vulnerability?
All versions of kin-openapi prior to 0.146.0 are affected by CVE-2026-100349.
Is there a fix available for this issue?
Yes, the issue is fixed in version 0.146.0 of the kin-openapi library.
What is the severity rating for CVE-2026-100349?
The National Vulnerability Database rates this vulnerability as high severity with a CVSS score of 8.2.
