Sign in Sign up
JA · EN · FR
SecPulse
Categories
CVE-2026-100349 high CVSS 7.5

Vulnerability in github.com/getkin/kin-openapi (CVE-2026-100349)

Summary

Vulnerability in github.com/getkin/kin-openapi (CVE-2026-100349). Risk of unauthorized operations or information disclosure. Exploitable via ValidateResponse. Mitigation: upgrade to 0.146.0 or later.

Original description

The description as published by the source.

Summary

ValidateResponse panics on a nil pointer when a spec declares a response header with content instead of schema. doc.Validate() accepts that document, so the crash comes from a spec the library just called valid.

Same class as GHSA-jpcw-4wr7-c3vq, which covered the request-parameter case in v0.144.0; this is the response-header path.

Affects github.com/getkin/kin-openapi <= v0.145.0. Reproduced on master 947498e5a6bd, Go 1.26.

Details

A content-typed response header has headerRef.Value.Schema == nil.

validate_response.go:181 passes it straight through:

if decodedValue, found, err = decodeValue(dec, headerName, sm, headerRef.Value.Schema, headerRef.Value.Required); err != nil {

and req_resp_decoder.go:273 is where it lands:

if len(schema.Value.AllOf) > 0 {

Two things I checked rather than assumed. The response does not need to carry the header; declaring it is enough, and then every call for that operation panics. And the body path is fine, :114 returns early on a nil schema, so this is headers only. The PoC keeps the body case as a control.

PoC

Drop into openapi3filter/ and run:

go test ./openapi3filter/ -run NilSchema -v

package openapi3filter_test

import (
	"context"
	"io"
	"net/http"
	"net/http/httptest"
	"strings"
	"testing"

	"github.com/getkin/kin-openapi/openapi3"
	"github.com/getkin/kin-openapi/openapi3filter"
	"github.com/getkin/kin-openapi/routers"
)

const specBody = `
openap…

Source: NIST National Vulnerability Database NVD GitHub Advisory

Auto-generated summary

Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.

A vulnerability tracked as CVE-2026-100349 has been found in github.com/getkin/kin-openapi.
Attackers can target a specific entry point like ValidateResponse over the network to misuse the product.
Risk of unauthorized operations or information disclosure. CVSS score: 7.5/10.
What to do: upgrade github.com/getkin/kin-openapi to 0.146.0 or later.
If unsure, ask your IT team or search "github.com/getkin/kin-openapi CVE-2026-100349" on the vendor's site.

CVE-2026-100349 (github.com/getkin/kin-openapi) — CWE-476 / CVSS v3 7.5
Attack vector: remote (network-reachable) / unauthenticated / no user interaction
Attack surface: ValidateResponse / content / schema / FAIL
Patched: 0.146.0 — apply immediately
Workaround: Use schema on the response header, or skip ValidateResponse for those operations.
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.

❓ What is the problem

A vulnerability (CWE-476) exists in github.com/getkin/kin-openapi. Attackers reach the vulnerable code path via ValidateResponse without authentication.

📍 Affected scope

Check the vendor advisory for the affected versions of github.com/getkin/kin-openapi. Attack surface: ValidateResponse / content / schema / FAIL.

🔥 Severity

Severity: High (CVSS 7.5/10). Risk of unauthorized operations or information disclosure.

🔧 How to fix

Update to 0.146.0.

🛡️ Workaround

Workaround: Use schema on the response header, or skip ValidateResponse for those operations.

🔍 Detection

Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'github.com/getkin/kin-openapi' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

  1. 1
    Identify exposure identify 
    grep -r 'github.com/getkin/kin-openapi' . | grep -v node_modules

    リポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で github.com/getkin/kin-openapi を grep し、稼働しているサービス・バージョンを把握する。

  2. 2
    Apply temporary workaround mitigate 
    Use `schema` on the response header, or skip `ValidateResponse` for those operations.

    パッチが適用されるまでの応急処置として、Use schema on the response header, or skip ValidateResponse for those operations. を実施。回避策の副作用 (機能低下) を確認した上で。

  3. 3
    Apply patch patch 
    Upgrade github.com/getkin/kin-openapi to 0.146.0

    ステージング環境で 0.146.0 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。

  4. 4
    Post-deployment verification verify 
    Confirm patched version is live in production

    パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。

Affected packages

go github.com/getkin/kin-openapi
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.146.0"}]}]

References

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details