CVE-2026-100349: CWE-476: NULL Pointer Dereference in getkin kin-openapi

In kin-openapi versions before 0.146.0, the function openapi3filter.ValidateResponse incorrectly handles OpenAPI documents that declare headers with content instead of schema by passing a nil schema to decodeValue. This leads to a NULL pointer dereference and a panic during response validation for affected operations, regardless of whether the response includes the declared header. Applications that process untrusted OpenAPI specifications may expose this as a remote availability impact, while even trusted local specifications cause crashes when exercising the affected operation. The vulnerability is addressed in kin-openapi version 0.146.0.

This vulnerability can cause kin-openapi-based applications to crash (panic) during response validation, resulting in a denial of service or availability impact. Applications ingesting untrusted OpenAPI specifications remotely may be exposed to this issue, while applications using trusted local specifications will still experience crashes when exercising the affected operation.

Upgrade kin-openapi to version 0.146.0 or later, where this NULL pointer dereference issue is fixed. No other mitigation is indicated by the vendor advisory.