NULL pointer dereference in kin-openapi - #VU140829
Published: August 3, 2026
Vulnerability identifier: #VU140829
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-476
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to null pointer dereference in openapi3filter.ValidateResponse response header validation when processing a valid OpenAPI specification that declares a response header with content instead of schema. A remote attacker can send a request to an affected operation to cause a denial of service.
The issue affects response-header validation only, and declaring the header is sufficient to trigger the panic on every call to the operation even if the response does not include that header.
Affected software
kin-openapi
Remediation
Install security update from vendor's website.
kin-openapi - update to 0.146.0