Search: CVE-2026-100349

CVE-2026-100349 is a NULL pointer dereference vulnerability in the kin-openapi library (github.com/getkin/kin-openapi) affecting versions up to 0.145.0. The issue occurs when a response header in an OpenAPI spec declares a 'content' field instead of a 'schema', causing the ValidateResponse function to panic due to a nil pointer dereference. This crash happens even though the document passes validation, leading to a process crash on every call to the affected operation. The vulnerability can cause denial of service if the spec is attacker-controlled or comes from an untrusted source.