{ "document": { "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this portal to enhance access to its information and vulnerabilities. The use of this information is subject to the following terms and conditions:\n\nThe vulnerabilities disclosed in this portal are gathered by NCSC-NL from a variety of open sources, which the user can retrieve from other platforms. NCSC-NL makes every reasonable effort to ensure that the content of this portal is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or real-time keeping up-to-date. NCSC-NL does not control nor guarantee the accuracy, relevance, timeliness or completeness of information obtained from these external sources. The vulnerabilities disclosed in this portal are intended solely for the convenience of professional parties to take appropriate measures to manage the risks posed to the cybersecurity. No rights can be derived from the information provided therein.\n\nNCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of the vulnerabilities disclosed in this portal. This includes damage resulting from the inaccuracy of incompleteness of the information contained in it.\nThe information on this page is subject to Dutch law. All disputes related to or arising from the use of this portal regarding the disclosure of vulnerabilities will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings." } ], "publisher": { "category": "coordinator", "contact_details": "cert@ncsc.nl", "name": "National Cyber Security Centre", "namespace": "https://www.ncsc.nl/" }, "title": "CVE-2026-100349", "tracking": { "current_release_date": "2026-10-30T15:18:44.735771Z", "generator": { "date": "2026-02-17T15:00:00Z", "engine": { "name": "V.E.L.M.A", "version": "1.7" } }, "id": "CVE-2026-100349", "initial_release_date": "2026-10-15T17:06:12.764705Z", "revision_history": [ { "date": "2026-10-15T17:06:12.764705Z", "number": "1", "summary": "CVE created.| Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (3).| CWES updated (1)." }, { "date": "2026-10-15T17:06:20.235013Z", "number": "2", "summary": "NCSC Score created." }, { "date": "2026-10-16T00:28:24.101158Z", "number": "3", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (6).| Product Identifiers created (1).| References created (5).| CWES updated (1).| Vendor_assessment created." }, { "date": "2026-10-16T00:28:27.907891Z", "number": "4", "summary": "NCSC Score updated." }, { "date": "2026-10-16T18:43:55.757754Z", "number": "5", "summary": "Source created.| CVE status created. (valid)| Description created for source.| Products connected (1)." }, { "date": "2026-10-16T18:43:57.137557Z", "number": "6", "summary": "NCSC Score updated." }, { "date": "2026-10-16T20:39:54.342600Z", "number": "7", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (5).| CWES updated (1)." }, { "date": "2026-10-16T20:39:58.848277Z", "number": "8", "summary": "NCSC Score updated." }, { "date": "2026-10-17T14:28:27.795762Z", "number": "9", "summary": "NCSC Score updated." }, { "date": "2026-10-19T09:36:25.532957Z", "number": "10", "summary": "CVSS created.| CWES created (1).| Products created (1).| References created (3).| Description created for source.| Unknown change." }, { "date": "2026-10-19T09:36:30.654124Z", "number": "11", "summary": "NCSC Score updated." }, { "date": "2026-10-19T12:22:16.623233Z", "number": "12", "summary": "Unknown change." }, { "date": "2026-10-19T12:25:32.463943Z", "number": "13", "summary": "CVSS created.| CWES created (1).| Products created (149).| References created (5).| Description created for source.| Unknown change." }, { "date": "2026-10-20T07:30:54.846343Z", "number": "14", "summary": "EPSS created.| Unknown change." }, { "date": "2026-10-20T07:40:02.185982Z", "number": "15", "summary": "NCSC Score updated." }, { "date": "2026-10-20T18:44:17.708554Z", "number": "16", "summary": "CVSS created.| CWES created (1).| Products created (1).| References created (4).| Description created for source.| Unknown change." }, { "date": "2026-10-21T00:52:36.571854Z", "number": "17", "summary": "Source connected.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (2).| Product Remediations created (2).| Product Identifiers created (4).| Product Identifiers removed (4).| References created (19).| CWES updated (1)." }, { "date": "2026-10-21T00:52:49.682806Z", "number": "18", "summary": "NCSC Score updated." }, { "date": "2026-10-22T13:51:42.655770Z", "number": "19", "summary": "Source connected.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (2).| Product Remediations created (2).| Product Identifiers created (4).| Product Identifiers removed (4).| References created (23).| CWES updated (1)." }, { "date": "2026-10-22T13:51:44.779837Z", "number": "20", "summary": "NCSC Score updated." }, { "date": "2026-10-30T15:18:35.810350Z", "number": "21", "summary": "EPSS updated." }, { "date": "2026-10-30T15:18:41.574500Z", "number": "22", "summary": "NCSC Score updated." } ], "status": "interim", "version": "22" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:rpm/1", "product": { "name": "vers:rpm/1", "product_id": "CSAFPID-6014972", "product_identification_helper": { "cpe": "cpe:/a:redhat:hummingbird:1" } } } ], "category": "product_name", "name": "Red Hat Hardened Images" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-9710183" } } ], "category": "product_name", "name": "go-fdo-server" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-8902830" } } ], "category": "product_name", "name": "grafana12.4" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/13.1.8-0.3.hum1", "product": { "name": "vers:rpm/13.1.8-0.3.hum1", "product_id": "CSAFPID-9821941", "product_identification_helper": { "purl": "pkg:rpm/redhat/grafana13.1@13.1.8-0.3.hum1?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms" } } }, { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-8902831" } } ], "category": "product_name", "name": "grafana13.1" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/13.2.3-0.3.hum1", "product": { "name": "vers:rpm/13.2.3-0.3.hum1", "product_id": "CSAFPID-9764774", "product_identification_helper": { "purl": "pkg:rpm/redhat/grafana13.2@13.2.3-0.3.hum1?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms" } } }, { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-9053231" } } ], "category": "product_name", "name": "grafana13.2" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-9053232" } } ], "category": "product_name", "name": "hugo" } ], "category": "product_family", "name": "Red Hat Hardened Images" } ], "category": "vendor", "name": "Red Hat" }, { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:deb/unknown", "product": { "name": "vers:deb/unknown", "product_id": "CSAFPID-8980229" } } ], "category": "product_name", "name": "golang-github-getkin-kin-openapi" } ], "category": "product_family", "name": "bookworm" } ], "category": "vendor", "name": "debian" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/<0.146.0", "product": { "name": "vers:unknown/<0.146.0", "product_id": "CSAFPID-9725800" } }, { "category": "product_version_range", "name": "vers:unknown/>=0|<0.146.0", "product": { "name": "vers:unknown/>=0|<0.146.0", "product_id": "CSAFPID-9754966" } }, { "category": "product_version_range", "name": "vers:unknown/v0.1.0", "product": { "name": "vers:unknown/v0.1.0", "product_id": "CSAFPID-3787747" } }, { "category": "product_version_range", "name": "vers:unknown/v0.10.0", "product": { "name": "vers:unknown/v0.10.0", "product_id": "CSAFPID-3787748" } }, { "category": "product_version_range", "name": "vers:unknown/v0.100.0", "product": { "name": "vers:unknown/v0.100.0", "product_id": "CSAFPID-3787749" } }, { "category": "product_version_range", "name": "vers:unknown/v0.101.0", "product": { "name": "vers:unknown/v0.101.0", "product_id": "CSAFPID-3787750" } }, { "category": "product_version_range", "name": "vers:unknown/v0.102.0", "product": { "name": "vers:unknown/v0.102.0", "product_id": "CSAFPID-3787751" } }, { "category": "product_version_range", "name": "vers:unknown/v0.103.0", "product": { "name": "vers:unknown/v0.103.0", "product_id": "CSAFPID-3787752" } }, { "category": "product_version_range", "name": "vers:unknown/v0.104.0", "product": { "name": "vers:unknown/v0.104.0", "product_id": "CSAFPID-3787753" } }, { "category": "product_version_range", "name": "vers:unknown/v0.105.0", "product": { "name": "vers:unknown/v0.105.0", "product_id": "CSAFPID-3787754" } }, { "category": "product_version_range", "name": "vers:unknown/v0.106.0", "product": { "name": "vers:unknown/v0.106.0", "product_id": "CSAFPID-3787755" } }, { "category": "product_version_range", "name": "vers:unknown/v0.107.0", "product": { "name": "vers:unknown/v0.107.0", "product_id": "CSAFPID-3787756" } }, { "category": "product_version_range", "name": "vers:unknown/v0.108.0", "product": { "name": "vers:unknown/v0.108.0", "product_id": "CSAFPID-3787757" } }, { "category": "product_version_range", "name": "vers:unknown/v0.109.0", "product": { "name": "vers:unknown/v0.109.0", "product_id": "CSAFPID-3787758" } }, { "category": "product_version_range", "name": "vers:unknown/v0.11.0", "product": { "name": "vers:unknown/v0.11.0", "product_id": "CSAFPID-3787759" } }, { "category": "product_version_range", "name": "vers:unknown/v0.110.0", "product": { "name": "vers:unknown/v0.110.0", "product_id": "CSAFPID-3787760" } }, { "category": "product_version_range", "name": "vers:unknown/v0.111.0", "product": { "name": "vers:unknown/v0.111.0", "product_id": "CSAFPID-3787761" } }, { "category": "product_version_range", "name": "vers:unknown/v0.112.0", "product": { "name": "vers:unknown/v0.112.0", "product_id": "CSAFPID-3787762" } }, { "category": "product_version_range", "name": "vers:unknown/v0.113.0", "product": { "name": "vers:unknown/v0.113.0", "product_id": "CSAFPID-3787763" } }, { "category": "product_version_range", "name": "vers:unknown/v0.114.0", "product": { "name": "vers:unknown/v0.114.0", "product_id": "CSAFPID-3787764" } }, { "category": "product_version_range", "name": "vers:unknown/v0.115.0", "product": { "name": "vers:unknown/v0.115.0", "product_id": "CSAFPID-3787765" } }, { "category": "product_version_range", "name": "vers:unknown/v0.116.0", "product": { "name": "vers:unknown/v0.116.0", "product_id": "CSAFPID-3787766" } }, { "category": "product_version_range", "name": "vers:unknown/v0.117.0", "product": { "name": "vers:unknown/v0.117.0", "product_id": "CSAFPID-3787767" } }, { "category": "product_version_range", "name": "vers:unknown/v0.118.0", "product": { "name": "vers:unknown/v0.118.0", "product_id": "CSAFPID-3787768" } }, { "category": "product_version_range", "name": "vers:unknown/v0.119.0", "product": { "name": "vers:unknown/v0.119.0", "product_id": "CSAFPID-3787769" } }, { "category": "product_version_range", "name": "vers:unknown/v0.12.0", "product": { "name": "vers:unknown/v0.12.0", "product_id": "CSAFPID-3787770" } }, { "category": "product_version_range", "name": "vers:unknown/v0.120.0", "product": { "name": "vers:unknown/v0.120.0", "product_id": "CSAFPID-3787771" } }, { "category": "product_version_range", "name": "vers:unknown/v0.121.0", "product": { "name": "vers:unknown/v0.121.0", "product_id": "CSAFPID-3787772" } }, { "category": "product_version_range", "name": "vers:unknown/v0.122.0", "product": { "name": "vers:unknown/v0.122.0", "product_id": "CSAFPID-3787773" } }, { "category": "product_version_range", "name": "vers:unknown/v0.123.0", "product": { "name": "vers:unknown/v0.123.0", "product_id": "CSAFPID-3787774" } }, { "category": "product_version_range", "name": "vers:unknown/v0.124.0", "product": { "name": "vers:unknown/v0.124.0", "product_id": "CSAFPID-3787775" } }, { "category": "product_version_range", "name": "vers:unknown/v0.125.0", "product": { "name": "vers:unknown/v0.125.0", "product_id": "CSAFPID-3787776" } }, { "category": "product_version_range", "name": "vers:unknown/v0.126.0", "product": { "name": "vers:unknown/v0.126.0", "product_id": "CSAFPID-3787777" } }, { "category": "product_version_range", "name": "vers:unknown/v0.127.0", "product": { "name": "vers:unknown/v0.127.0", "product_id": "CSAFPID-3787778" } }, { "category": "product_version_range", "name": "vers:unknown/v0.128.0", "product": { "name": "vers:unknown/v0.128.0", "product_id": "CSAFPID-3787779" } }, { "category": "product_version_range", "name": "vers:unknown/v0.129.0", "product": { "name": "vers:unknown/v0.129.0", "product_id": "CSAFPID-3787780" } }, { "category": "product_version_range", "name": "vers:unknown/v0.13.0", "product": { "name": "vers:unknown/v0.13.0", "product_id": "CSAFPID-3787781" } }, { "category": "product_version_range", "name": "vers:unknown/v0.130.0", "product": { "name": "vers:unknown/v0.130.0", "product_id": "CSAFPID-3787782" } }, { "category": "product_version_range", "name": "vers:unknown/v0.131.0", "product": { "name": "vers:unknown/v0.131.0", "product_id": "CSAFPID-8978171" } }, { "category": "product_version_range", "name": "vers:unknown/v0.132.0", "product": { "name": "vers:unknown/v0.132.0", "product_id": "CSAFPID-8978170" } }, { "category": "product_version_range", "name": "vers:unknown/v0.133.0", "product": { "name": "vers:unknown/v0.133.0", "product_id": "CSAFPID-8978169" } }, { "category": "product_version_range", "name": "vers:unknown/v0.134.0", "product": { "name": "vers:unknown/v0.134.0", "product_id": "CSAFPID-8978168" } }, { "category": "product_version_range", "name": "vers:unknown/v0.135.0", "product": { "name": "vers:unknown/v0.135.0", "product_id": "CSAFPID-8978167" } }, { "category": "product_version_range", "name": "vers:unknown/v0.136.0", "product": { "name": "vers:unknown/v0.136.0", "product_id": "CSAFPID-8978166" } }, { "category": "product_version_range", "name": "vers:unknown/v0.137.0", "product": { "name": "vers:unknown/v0.137.0", "product_id": "CSAFPID-8978165" } }, { "category": "product_version_range", "name": "vers:unknown/v0.138.0", "product": { "name": "vers:unknown/v0.138.0", "product_id": "CSAFPID-8978164" } }, { "category": "product_version_range", "name": "vers:unknown/v0.139.0", "product": { "name": "vers:unknown/v0.139.0", "product_id": "CSAFPID-8978163" } }, { "category": "product_version_range", "name": "vers:unknown/v0.14.0", "product": { "name": "vers:unknown/v0.14.0", "product_id": "CSAFPID-3787783" } }, { "category": "product_version_range", "name": "vers:unknown/v0.140.0", "product": { "name": "vers:unknown/v0.140.0", "product_id": "CSAFPID-8978162" } }, { "category": "product_version_range", "name": "vers:unknown/v0.141.0", "product": { "name": "vers:unknown/v0.141.0", "product_id": "CSAFPID-8978161" } }, { "category": "product_version_range", "name": "vers:unknown/v0.142.0", "product": { "name": "vers:unknown/v0.142.0", "product_id": "CSAFPID-8978160" } }, { "category": "product_version_range", "name": "vers:unknown/v0.143.0", "product": { "name": "vers:unknown/v0.143.0", "product_id": "CSAFPID-8978159" } }, { "category": "product_version_range", "name": "vers:unknown/v0.144.0", "product": { "name": "vers:unknown/v0.144.0", "product_id": "CSAFPID-9727426" } }, { "category": "product_version_range", "name": "vers:unknown/v0.145.0", "product": { "name": "vers:unknown/v0.145.0", "product_id": "CSAFPID-9727427" } }, { "category": "product_version_range", "name": "vers:unknown/v0.15.0", "product": { "name": "vers:unknown/v0.15.0", "product_id": "CSAFPID-3787784" } }, { "category": "product_version_range", "name": "vers:unknown/v0.16.0", "product": { "name": "vers:unknown/v0.16.0", "product_id": "CSAFPID-3787785" } }, { "category": "product_version_range", "name": "vers:unknown/v0.17.0", "product": { "name": "vers:unknown/v0.17.0", "product_id": "CSAFPID-3787786" } }, { "category": "product_version_range", "name": "vers:unknown/v0.18.0", "product": { "name": "vers:unknown/v0.18.0", "product_id": "CSAFPID-3787787" } }, { "category": "product_version_range", "name": "vers:unknown/v0.19.0", "product": { "name": "vers:unknown/v0.19.0", "product_id": "CSAFPID-3787788" } }, { "category": "product_version_range", "name": "vers:unknown/v0.2.0", "product": { "name": "vers:unknown/v0.2.0", "product_id": "CSAFPID-3787789" } }, { "category": "product_version_range", "name": "vers:unknown/v0.20.0", "product": { "name": "vers:unknown/v0.20.0", "product_id": "CSAFPID-3787790" } }, { "category": "product_version_range", "name": "vers:unknown/v0.21.0", "product": { "name": "vers:unknown/v0.21.0", "product_id": "CSAFPID-3787791" } }, { "category": "product_version_range", "name": "vers:unknown/v0.22.0", "product": { "name": "vers:unknown/v0.22.0", "product_id": "CSAFPID-3787792" } }, { "category": "product_version_range", "name": "vers:unknown/v0.22.1", "product": { "name": "vers:unknown/v0.22.1", "product_id": "CSAFPID-3787793" } }, { "category": "product_version_range", "name": "vers:unknown/v0.23.0", "product": { "name": "vers:unknown/v0.23.0", "product_id": "CSAFPID-3787794" } }, { "category": "product_version_range", "name": "vers:unknown/v0.24.0", "product": { "name": "vers:unknown/v0.24.0", "product_id": "CSAFPID-3787795" } }, { "category": "product_version_range", "name": "vers:unknown/v0.25.0", "product": { "name": "vers:unknown/v0.25.0", "product_id": "CSAFPID-3787796" } }, { "category": "product_version_range", "name": "vers:unknown/v0.26.0", "product": { "name": "vers:unknown/v0.26.0", "product_id": "CSAFPID-3787797" } }, { "category": "product_version_range", "name": "vers:unknown/v0.27.0", "product": { "name": "vers:unknown/v0.27.0", "product_id": "CSAFPID-3787798" } }, { "category": "product_version_range", "name": "vers:unknown/v0.28.0", "product": { "name": "vers:unknown/v0.28.0", "product_id": "CSAFPID-3787799" } }, { "category": "product_version_range", "name": "vers:unknown/v0.29.0", "product": { "name": "vers:unknown/v0.29.0", "product_id": "CSAFPID-3787800" } }, { "category": "product_version_range", "name": "vers:unknown/v0.3.0", "product": { "name": "vers:unknown/v0.3.0", "product_id": "CSAFPID-3787801" } }, { "category": "product_version_range", "name": "vers:unknown/v0.3.1", "product": { "name": "vers:unknown/v0.3.1", "product_id": "CSAFPID-3787802" } }, { "category": "product_version_range", "name": "vers:unknown/v0.30.0", "product": { "name": "vers:unknown/v0.30.0", "product_id": "CSAFPID-3787803" } }, { "category": "product_version_range", "name": "vers:unknown/v0.31.0", "product": { "name": "vers:unknown/v0.31.0", "product_id": "CSAFPID-3787804" } }, { "category": "product_version_range", "name": "vers:unknown/v0.32.0", "product": { "name": "vers:unknown/v0.32.0", "product_id": "CSAFPID-3787805" } }, { "category": "product_version_range", "name": "vers:unknown/v0.33.0", "product": { "name": "vers:unknown/v0.33.0", "product_id": "CSAFPID-3787806" } }, { "category": "product_version_range", "name": "vers:unknown/v0.34.0", "product": { "name": "vers:unknown/v0.34.0", "product_id": "CSAFPID-3787807" } }, { "category": "product_version_range", "name": "vers:unknown/v0.35.0", "product": { "name": "vers:unknown/v0.35.0", "product_id": "CSAFPID-3787808" } }, { "category": "product_version_range", "name": "vers:unknown/v0.36.0", "product": { "name": "vers:unknown/v0.36.0", "product_id": "CSAFPID-3787809" } }, { "category": "product_version_range", "name": "vers:unknown/v0.37.0", "product": { "name": "vers:unknown/v0.37.0", "product_id": "CSAFPID-3787810" } }, { "category": "product_version_range", "name": "vers:unknown/v0.38.0", "product": { "name": "vers:unknown/v0.38.0", "product_id": "CSAFPID-3787811" } }, { "category": "product_version_range", "name": "vers:unknown/v0.39.0", "product": { "name": "vers:unknown/v0.39.0", "product_id": "CSAFPID-3787812" } }, { "category": "product_version_range", "name": "vers:unknown/v0.4.0", "product": { "name": "vers:unknown/v0.4.0", "product_id": "CSAFPID-3787813" } }, { "category": "product_version_range", "name": "vers:unknown/v0.40.0", "product": { "name": "vers:unknown/v0.40.0", "product_id": "CSAFPID-3787814" } }, { "category": "product_version_range", "name": "vers:unknown/v0.41.0", "product": { "name": "vers:unknown/v0.41.0", "product_id": "CSAFPID-3787815" } }, { "category": "product_version_range", "name": "vers:unknown/v0.42.0", "product": { "name": "vers:unknown/v0.42.0", "product_id": "CSAFPID-3787816" } }, { "category": "product_version_range", "name": "vers:unknown/v0.43.0", "product": { "name": "vers:unknown/v0.43.0", "product_id": "CSAFPID-3787817" } }, { "category": "product_version_range", "name": "vers:unknown/v0.44.0", "product": { "name": "vers:unknown/v0.44.0", "product_id": "CSAFPID-3787818" } }, { "category": "product_version_range", "name": "vers:unknown/v0.45.0", "product": { "name": "vers:unknown/v0.45.0", "product_id": "CSAFPID-3787819" } }, { "category": "product_version_range", "name": "vers:unknown/v0.45.1", "product": { "name": "vers:unknown/v0.45.1", "product_id": "CSAFPID-3787820" } }, { "category": "product_version_range", "name": "vers:unknown/v0.46.0", "product": { "name": "vers:unknown/v0.46.0", "product_id": "CSAFPID-3787821" } }, { "category": "product_version_range", "name": "vers:unknown/v0.47.0", "product": { "name": "vers:unknown/v0.47.0", "product_id": "CSAFPID-3787822" } }, { "category": "product_version_range", "name": "vers:unknown/v0.48.0", "product": { "name": "vers:unknown/v0.48.0", "product_id": "CSAFPID-3787823" } }, { "category": "product_version_range", "name": "vers:unknown/v0.49.0", "product": { "name": "vers:unknown/v0.49.0", "product_id": "CSAFPID-3787824" } }, { "category": "product_version_range", "name": "vers:unknown/v0.5.0", "product": { "name": "vers:unknown/v0.5.0", "product_id": "CSAFPID-3787825" } }, { "category": "product_version_range", "name": "vers:unknown/v0.5.1", "product": { "name": "vers:unknown/v0.5.1", "product_id": "CSAFPID-3787826" } }, { "category": "product_version_range", "name": "vers:unknown/v0.50.0", "product": { "name": "vers:unknown/v0.50.0", "product_id": "CSAFPID-3787827" } }, { "category": "product_version_range", "name": "vers:unknown/v0.51.0", "product": { "name": "vers:unknown/v0.51.0", "product_id": "CSAFPID-3787828" } }, { "category": "product_version_range", "name": "vers:unknown/v0.52.0", "product": { "name": "vers:unknown/v0.52.0", "product_id": "CSAFPID-3787829" } }, { "category": "product_version_range", "name": "vers:unknown/v0.53.0", "product": { "name": "vers:unknown/v0.53.0", "product_id": "CSAFPID-3787830" } }, { "category": "product_version_range", "name": "vers:unknown/v0.54.0", "product": { "name": "vers:unknown/v0.54.0", "product_id": "CSAFPID-3787831" } }, { "category": "product_version_range", "name": "vers:unknown/v0.55.0", "product": { "name": "vers:unknown/v0.55.0", "product_id": "CSAFPID-3787832" } }, { "category": "product_version_range", "name": "vers:unknown/v0.56.0", "product": { "name": "vers:unknown/v0.56.0", "product_id": "CSAFPID-3787833" } }, { "category": "product_version_range", "name": "vers:unknown/v0.57.0", "product": { "name": "vers:unknown/v0.57.0", "product_id": "CSAFPID-3787834" } }, { "category": "product_version_range", "name": "vers:unknown/v0.58.0", "product": { "name": "vers:unknown/v0.58.0", "product_id": "CSAFPID-3787835" } }, { "category": "product_version_range", "name": "vers:unknown/v0.59.0", "product": { "name": "vers:unknown/v0.59.0", "product_id": "CSAFPID-3787836" } }, { "category": "product_version_range", "name": "vers:unknown/v0.6.0", "product": { "name": "vers:unknown/v0.6.0", "product_id": "CSAFPID-3787837" } }, { "category": "product_version_range", "name": "vers:unknown/v0.60.0", "product": { "name": "vers:unknown/v0.60.0", "product_id": "CSAFPID-3787838" } }, { "category": "product_version_range", "name": "vers:unknown/v0.61.0", "product": { "name": "vers:unknown/v0.61.0", "product_id": "CSAFPID-3787839" } }, { "category": "product_version_range", "name": "vers:unknown/v0.62.0", "product": { "name": "vers:unknown/v0.62.0", "product_id": "CSAFPID-3787840" } }, { "category": "product_version_range", "name": "vers:unknown/v0.63.0", "product": { "name": "vers:unknown/v0.63.0", "product_id": "CSAFPID-3787841" } }, { "category": "product_version_range", "name": "vers:unknown/v0.64.0", "product": { "name": "vers:unknown/v0.64.0", "product_id": "CSAFPID-3787842" } }, { "category": "product_version_range", "name": "vers:unknown/v0.65.0", "product": { "name": "vers:unknown/v0.65.0", "product_id": "CSAFPID-3787843" } }, { "category": "product_version_range", "name": "vers:unknown/v0.66.0", "product": { "name": "vers:unknown/v0.66.0", "product_id": "CSAFPID-3787844" } }, { "category": "product_version_range", "name": "vers:unknown/v0.67.0", "product": { "name": "vers:unknown/v0.67.0", "product_id": "CSAFPID-3787845" } }, { "category": "product_version_range", "name": "vers:unknown/v0.68.0", "product": { "name": "vers:unknown/v0.68.0", "product_id": "CSAFPID-3787846" } }, { "category": "product_version_range", "name": "vers:unknown/v0.69.0", "product": { "name": "vers:unknown/v0.69.0", "product_id": "CSAFPID-3787847" } }, { "category": "product_version_range", "name": "vers:unknown/v0.7.0", "product": { "name": "vers:unknown/v0.7.0", "product_id": "CSAFPID-3787848" } }, { "category": "product_version_range", "name": "vers:unknown/v0.70.0", "product": { "name": "vers:unknown/v0.70.0", "product_id": "CSAFPID-3787849" } }, { "category": "product_version_range", "name": "vers:unknown/v0.71.0", "product": { "name": "vers:unknown/v0.71.0", "product_id": "CSAFPID-3787850" } }, { "category": "product_version_range", "name": "vers:unknown/v0.72.0", "product": { "name": "vers:unknown/v0.72.0", "product_id": "CSAFPID-3787851" } }, { "category": "product_version_range", "name": "vers:unknown/v0.73.0", "product": { "name": "vers:unknown/v0.73.0", "product_id": "CSAFPID-3787852" } }, { "category": "product_version_range", "name": "vers:unknown/v0.74.0", "product": { "name": "vers:unknown/v0.74.0", "product_id": "CSAFPID-3787853" } }, { "category": "product_version_range", "name": "vers:unknown/v0.75.0", "product": { "name": "vers:unknown/v0.75.0", "product_id": "CSAFPID-3787854" } }, { "category": "product_version_range", "name": "vers:unknown/v0.76.0", "product": { "name": "vers:unknown/v0.76.0", "product_id": "CSAFPID-3787855" } }, { "category": "product_version_range", "name": "vers:unknown/v0.77.0", "product": { "name": "vers:unknown/v0.77.0", "product_id": "CSAFPID-3787856" } }, { "category": "product_version_range", "name": "vers:unknown/v0.78.0", "product": { "name": "vers:unknown/v0.78.0", "product_id": "CSAFPID-3787857" } }, { "category": "product_version_range", "name": "vers:unknown/v0.79.0", "product": { "name": "vers:unknown/v0.79.0", "product_id": "CSAFPID-3787858" } }, { "category": "product_version_range", "name": "vers:unknown/v0.8.0", "product": { "name": "vers:unknown/v0.8.0", "product_id": "CSAFPID-3787859" } }, { "category": "product_version_range", "name": "vers:unknown/v0.80.0", "product": { "name": "vers:unknown/v0.80.0", "product_id": "CSAFPID-3787860" } }, { "category": "product_version_range", "name": "vers:unknown/v0.81.0", "product": { "name": "vers:unknown/v0.81.0", "product_id": "CSAFPID-3787861" } }, { "category": "product_version_range", "name": "vers:unknown/v0.82.0", "product": { "name": "vers:unknown/v0.82.0", "product_id": "CSAFPID-3787862" } }, { "category": "product_version_range", "name": "vers:unknown/v0.83.0", "product": { "name": "vers:unknown/v0.83.0", "product_id": "CSAFPID-3787863" } }, { "category": "product_version_range", "name": "vers:unknown/v0.84.0", "product": { "name": "vers:unknown/v0.84.0", "product_id": "CSAFPID-3787864" } }, { "category": "product_version_range", "name": "vers:unknown/v0.85.0", "product": { "name": "vers:unknown/v0.85.0", "product_id": "CSAFPID-3787865" } }, { "category": "product_version_range", "name": "vers:unknown/v0.86.0", "product": { "name": "vers:unknown/v0.86.0", "product_id": "CSAFPID-3787866" } }, { "category": "product_version_range", "name": "vers:unknown/v0.87.0", "product": { "name": "vers:unknown/v0.87.0", "product_id": "CSAFPID-3787867" } }, { "category": "product_version_range", "name": "vers:unknown/v0.88.0", "product": { "name": "vers:unknown/v0.88.0", "product_id": "CSAFPID-3787868" } }, { "category": "product_version_range", "name": "vers:unknown/v0.89.0", "product": { "name": "vers:unknown/v0.89.0", "product_id": "CSAFPID-3787869" } }, { "category": "product_version_range", "name": "vers:unknown/v0.9.0", "product": { "name": "vers:unknown/v0.9.0", "product_id": "CSAFPID-3787870" } }, { "category": "product_version_range", "name": "vers:unknown/v0.90.0", "product": { "name": "vers:unknown/v0.90.0", "product_id": "CSAFPID-3787871" } }, { "category": "product_version_range", "name": "vers:unknown/v0.91.0", "product": { "name": "vers:unknown/v0.91.0", "product_id": "CSAFPID-3787872" } }, { "category": "product_version_range", "name": "vers:unknown/v0.92.0", "product": { "name": "vers:unknown/v0.92.0", "product_id": "CSAFPID-3787873" } }, { "category": "product_version_range", "name": "vers:unknown/v0.93.0", "product": { "name": "vers:unknown/v0.93.0", "product_id": "CSAFPID-3787874" } }, { "category": "product_version_range", "name": "vers:unknown/v0.94.0", "product": { "name": "vers:unknown/v0.94.0", "product_id": "CSAFPID-3787875" } }, { "category": "product_version_range", "name": "vers:unknown/v0.95.0", "product": { "name": "vers:unknown/v0.95.0", "product_id": "CSAFPID-3787876" } }, { "category": "product_version_range", "name": "vers:unknown/v0.96.0", "product": { "name": "vers:unknown/v0.96.0", "product_id": "CSAFPID-3787877" } }, { "category": "product_version_range", "name": "vers:unknown/v0.97.0", "product": { "name": "vers:unknown/v0.97.0", "product_id": "CSAFPID-3787878" } }, { "category": "product_version_range", "name": "vers:unknown/v0.98.0", "product": { "name": "vers:unknown/v0.98.0", "product_id": "CSAFPID-3787879" } }, { "category": "product_version_range", "name": "vers:unknown/v0.99.0", "product": { "name": "vers:unknown/v0.99.0", "product_id": "CSAFPID-3787880" } } ], "category": "product_name", "name": "kin-openapi" } ], "category": "vendor", "name": "getkin" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-100349", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "description", "text": "A flaw was found in kin-openapi. This vulnerability allows an attacker to cause a Denial of Service (DoS) by triggering an application crash during response validation. When an OpenAPI specification declares a response header using content rather than a schema, the validation logic attempts to dereference an uninitialized pointer, causing the application to panic and terminate.", "title": "redhat - https://access.redhat.com/errata/RHSA-2026:87077" }, { "category": "description", "text": "kin-openapi is a Go project for handling OpenAPI files. Prior to 0.146.0, openapi3filter.ValidateResponse passes a nil response header schema to decodeValue when an OpenAPI document declares the header with content instead of schema. The document passes validation, but every response validation for the affected operation dereferences the nil schema and panics even when the response does not contain the declared header. Applications that ingest an untrusted specification can expose this as remote availability impact, while applications using only trusted local specifications still crash when the affected operation is exercised. This issue is fixed in version 0.146.0.", "title": "nvd - https://nvd.nist.gov/vuln/detail/CVE-2026-100349" }, { "category": "description", "text": "A flaw was found in kin-openapi. This vulnerability allows an attacker to cause a Denial of Service (DoS) by triggering an application crash during response validation. When an OpenAPI specification declares a response header using content rather than a schema, the validation logic attempts to dereference an uninitialized pointer, causing the application to panic and terminate.", "title": "redhat - https://access.redhat.com/security/cve/CVE-2026-100349" }, { "category": "description", "text": "kin-openapi is a Go project for handling OpenAPI files. Prior to 0.146.0, openapi3filter.ValidateResponse passes a nil response header schema to decodeValue when an OpenAPI document declares the header with content instead of schema. The document passes validation, but every response validation for the affected operation dereferences the nil schema and panics even when the response does not contain the declared header. Applications that ingest an untrusted specification can expose this as remote availability impact, while applications using only trusted local specifications still crash when the affected operation is exercised. This issue is fixed in version 0.146.0.", "title": "debian - https://security-tracker.debian.org/tracker/CVE-2026-100349" }, { "category": "description", "text": "## Summary\n\n`ValidateResponse` panics on a nil pointer when a spec declares a response header with `content` instead of `schema`. `doc.Validate()` accepts that document, so the crash comes from a spec the library just called valid.\n\nSame class as GHSA-jpcw-4wr7-c3vq, which covered the request-parameter case in v0.144.0; this is the response-header path.\n\nAffects `github.com/getkin/kin-openapi` `<= v0.145.0`. Reproduced on master `947498e5a6bd`, Go 1.26.\n\n## Details\n\nA `content`-typed response header has `headerRef.Value.Schema == nil`.\n\n`validate_response.go:181` passes it straight through:\n\n```go\nif decodedValue, found, err = decodeValue(dec, headerName, sm, headerRef.Value.Schema, headerRef.Value.Required); err != nil {\n```\n\nand `req_resp_decoder.go:273` is where it lands:\n\n```go\nif len(schema.Value.AllOf) > 0 {\n```\n\nTwo things I checked rather than assumed. The response does not need to carry the header; declaring it is enough, and then every call for that operation panics. And the body path is fine, `:114` returns early on a nil schema, so this is headers only. The PoC keeps the body case as a control.\n\n## PoC\n\nDrop into `openapi3filter/` and run:\n\n```\ngo test ./openapi3filter/ -run NilSchema -v\n```\n\n```go\npackage openapi3filter_test\n\nimport (\n\t\"context\"\n\t\"io\"\n\t\"net/http\"\n\t\"net/http/httptest\"\n\t\"strings\"\n\t\"testing\"\n\n\t\"github.com/getkin/kin-openapi/openapi3\"\n\t\"github.com/getkin/kin-openapi/openapi3filter\"\n\t\"github.com/getkin/kin-openapi/routers\"\n)\n\nconst specBody = `\nopenapi: 3.0.3\ninfo: {title: poc, version: \"1.0.0\"}\npaths:\n /x:\n get:\n responses:\n \"200\":\n description: ok\n content:\n application/json: {}\n`\n\nconst specHeader = `\nopenapi: 3.0.3\ninfo: {title: poc, version: \"1.0.0\"}\npaths:\n /x:\n get:\n responses:\n \"200\":\n description: ok\n headers:\n X-Thing:\n content:\n application/json: {}\n`\n\nfunc validatedInput(t *testing.T, spec string, hdr http.Header) *openapi3filter.ResponseValidationInput {\n\tt.Helper()\n\tdoc, err := openapi3.NewLoader().LoadFromData([]byte(spec))\n\tif err != nil {\n\t\tt.Fatalf(\"load: %v\", err)\n\t}\n\tif err := doc.Validate(context.Background()); err != nil {\n\t\tt.Fatalf(\"doc.Validate rejected the spec, so this repro proves nothing: %v\", err)\n\t}\n\top := doc.Paths.Find(\"/x\").Get\n\treq := httptest.NewRequest(http.MethodGet, \"/x\", nil)\n\treturn &openapi3filter.ResponseValidationInput{\n\t\tRequestValidationInput: &openapi3filter.RequestValidationInput{\n\t\t\tRequest: req,\n\t\t\tRoute: &routers.Route{Spec: doc, Operation: op, Method: http.MethodGet, Path: \"/x\"},\n\t\t},\n\t\tStatus: 200,\n\t\tHeader: hdr,\n\t\tBody: io.NopCloser(strings.NewReader(`{}`)),\n\t}\n}\n\n// Control: body path returns early on a nil schema.\nfunc TestControl_ResponseBodyNilSchema(t *testing.T) {\n\tin := validatedInput(t, specBody, http.Header{\"Content-Type\": {\"application/json\"}})\n\tdefer func() {\n\t\tif r := recover(); r != nil {\n\t\t\tt.Errorf(\"body path panicked, expected clean return: %v\", r)\n\t\t}\n\t}()\n\tif err := openapi3filter.ValidateResponse(context.Background(), in); err != nil {\n\t\tt.Errorf(\"body path returned %v, expected nil\", err)\n\t}\n}\n\n// The response does not carry X-Thing. Declaring the header is enough.\nfunc TestResponseHeaderNilSchema(t *testing.T) {\n\tin := validatedInput(t, specHeader, http.Header{\"Content-Type\": {\"application/json\"}})\n\tif err := openapi3filter.ValidateResponse(context.Background(), in); err != nil {\n\t\tt.Fatalf(\"no panic; got err = %v (already fixed?)\", err)\n\t}\n}\n```\n\nOutput:\n\n```\n=== RUN TestControl_ResponseBodyNilSchema\n--- PASS: TestControl_ResponseBodyNilSchema (0.00s)\n=== RUN TestResponseHeaderNilSchema\n--- FAIL: TestResponseHeaderNilSchema (0.00s)\npanic: runtime error: invalid memory address or nil pointer dereference [recovered, repanicked]\n[signal SIGSEGV: segmentation violation code=0x1 addr=0x20 pc=0x7f6d2a]\n\ngithub.com/getkin/kin-openapi/openapi3filter.decodeValue(...)\n\t/src/openapi3filter/req_resp_decoder.go:273 +0x4a\ngithub.com/getkin/kin-openapi/openapi3filter.validateResponseHeader(...)\n\t/src/openapi3filter/validate_response.go:181 +0x146\ngithub.com/getkin/kin-openapi/openapi3filter.ValidateResponse(...)\n\t/src/openapi3filter/validate_response.go:89 +0xafa\n```\n\nThe `FAIL` is the point: control passes, the header case takes the binary down.\n\nRan in a container against a fresh clone of master. I have not tried it against a live proxy.\n\n## Impact\n\nA process crash instead of an error return. Declaring the header is enough, so it is every call on that operation rather than an occasional one.\n\nIf the spec comes from somewhere else -- gateways, linters, anything ingesting specs it did not write -- that is a trust boundary, and it becomes remote availability.\n\nIf it is your own spec, nothing attacker-controlled starts it, but any client reaching that route then crashes the process. It fires on every call, so normally you would see it the first time that route runs. A spec edited without exercising the route is the case where you would not. That is the difference from GHSA-jpcw, where the attacker supplied the trigger. I have left severity unset; the two cases do not score the same.\n\nOn how common it is, I checked rather than guessed. Of roughly 1,500 OpenAPI 3.x specs on apis.guru, one declares content-typed response headers -- VTEX Catalog API -- and not in one corner of it: the shape repeats across its operations, so for that consumer this is not an edge case.\n\nThe header names in it (`X-AspNet-Version`, `p3p`, a few malformed ones) look like a generator emitting `content` where it could not infer a schema, and apis.guru only indexes public specs. There is no content-typed response header in this repo's testdata either.\n\n## Workarounds\n\nUse `schema` on the response header, or skip `ValidateResponse` for those operations. `ExcludeResponseBody` will not do it -- headers are validated before that check.\n\n## Suggested fix\n\nNil-guard at the top of `decodeValue`:\n\n```go\nif schema == nil {\n\treturn nil, false, nil\n}\n```\n\nReturning nil leaves a `content`-typed header unvalidated rather than erroring, so it trades the crash for a silent gap. An error return kills the panic just as well if you would rather it surfaced.", "title": "github - https://github.com/advisories/GHSA-74vm-87hj-r66f" }, { "category": "description", "text": "kin-openapi is a Go project for handling OpenAPI files. Prior to 0.146.0, openapi3filter.ValidateResponse passes a nil response header schema to decodeValue when an OpenAPI document declares the header with content instead of schema. The document passes validation, but every response validation for the affected operation dereferences the nil schema and panics even when the response does not contain the declared header. Applications that ingest an untrusted specification can expose this as remote availability impact, while applications using only trusted local specifications still crash when the affected operation is exercised. This issue is fixed in version 0.146.0.", "title": "cveprojectv5 - https://www.cve.org/CVERecord?id=CVE-2026-100349" }, { "category": "description", "text": "kin-openapi is a Go project for handling OpenAPI files. Prior to 0.146.0, openapi3filter.ValidateResponse passes a nil response header schema to decodeValue when an OpenAPI document declares the header with content instead of schema. The document passes validation, but every response validation for the affected operation dereferences the nil schema and panics even when the response does not contain the declared header. Applications that ingest an untrusted specification can expose this as remote availability impact, while applications using only trusted local specifications still crash when the affected operation is exercised. This issue is fixed in version 0.146.0.", "title": "osvgit - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-100349.json?alt=media" }, { "category": "description", "text": "## Summary\n\n`ValidateResponse` panics on a nil pointer when a spec declares a response header with `content` instead of `schema`. `doc.Validate()` accepts that document, so the crash comes from a spec the library just called valid.\n\nSame class as GHSA-jpcw-4wr7-c3vq, which covered the request-parameter case in v0.144.0; this is the response-header path.\n\nAffects `github.com/getkin/kin-openapi` `<= v0.145.0`. Reproduced on master `947498e5a6bd`, Go 1.26.\n\n## Details\n\nA `content`-typed response header has `headerRef.Value.Schema == nil`.\n\n`validate_response.go:181` passes it straight through:\n\n```go\nif decodedValue, found, err = decodeValue(dec, headerName, sm, headerRef.Value.Schema, headerRef.Value.Required); err != nil {\n```\n\nand `req_resp_decoder.go:273` is where it lands:\n\n```go\nif len(schema.Value.AllOf) > 0 {\n```\n\nTwo things I checked rather than assumed. The response does not need to carry the header; declaring it is enough, and then every call for that operation panics. And the body path is fine, `:114` returns early on a nil schema, so this is headers only. The PoC keeps the body case as a control.\n\n## PoC\n\nDrop into `openapi3filter/` and run:\n\n```\ngo test ./openapi3filter/ -run NilSchema -v\n```\n\n```go\npackage openapi3filter_test\n\nimport (\n\t\"context\"\n\t\"io\"\n\t\"net/http\"\n\t\"net/http/httptest\"\n\t\"strings\"\n\t\"testing\"\n\n\t\"github.com/getkin/kin-openapi/openapi3\"\n\t\"github.com/getkin/kin-openapi/openapi3filter\"\n\t\"github.com/getkin/kin-openapi/routers\"\n)\n\nconst specBody = `\nopenapi: 3.0.3\ninfo: {title: poc, version: \"1.0.0\"}\npaths:\n /x:\n get:\n responses:\n \"200\":\n description: ok\n content:\n application/json: {}\n`\n\nconst specHeader = `\nopenapi: 3.0.3\ninfo: {title: poc, version: \"1.0.0\"}\npaths:\n /x:\n get:\n responses:\n \"200\":\n description: ok\n headers:\n X-Thing:\n content:\n application/json: {}\n`\n\nfunc validatedInput(t *testing.T, spec string, hdr http.Header) *openapi3filter.ResponseValidationInput {\n\tt.Helper()\n\tdoc, err := openapi3.NewLoader().LoadFromData([]byte(spec))\n\tif err != nil {\n\t\tt.Fatalf(\"load: %v\", err)\n\t}\n\tif err := doc.Validate(context.Background()); err != nil {\n\t\tt.Fatalf(\"doc.Validate rejected the spec, so this repro proves nothing: %v\", err)\n\t}\n\top := doc.Paths.Find(\"/x\").Get\n\treq := httptest.NewRequest(http.MethodGet, \"/x\", nil)\n\treturn &openapi3filter.ResponseValidationInput{\n\t\tRequestValidationInput: &openapi3filter.RequestValidationInput{\n\t\t\tRequest: req,\n\t\t\tRoute: &routers.Route{Spec: doc, Operation: op, Method: http.MethodGet, Path: \"/x\"},\n\t\t},\n\t\tStatus: 200,\n\t\tHeader: hdr,\n\t\tBody: io.NopCloser(strings.NewReader(`{}`)),\n\t}\n}\n\n// Control: body path returns early on a nil schema.\nfunc TestControl_ResponseBodyNilSchema(t *testing.T) {\n\tin := validatedInput(t, specBody, http.Header{\"Content-Type\": {\"application/json\"}})\n\tdefer func() {\n\t\tif r := recover(); r != nil {\n\t\t\tt.Errorf(\"body path panicked, expected clean return: %v\", r)\n\t\t}\n\t}()\n\tif err := openapi3filter.ValidateResponse(context.Background(), in); err != nil {\n\t\tt.Errorf(\"body path returned %v, expected nil\", err)\n\t}\n}\n\n// The response does not carry X-Thing. Declaring the header is enough.\nfunc TestResponseHeaderNilSchema(t *testing.T) {\n\tin := validatedInput(t, specHeader, http.Header{\"Content-Type\": {\"application/json\"}})\n\tif err := openapi3filter.ValidateResponse(context.Background(), in); err != nil {\n\t\tt.Fatalf(\"no panic; got err = %v (already fixed?)\", err)\n\t}\n}\n```\n\nOutput:\n\n```\n=== RUN TestControl_ResponseBodyNilSchema\n--- PASS: TestControl_ResponseBodyNilSchema (0.00s)\n=== RUN TestResponseHeaderNilSchema\n--- FAIL: TestResponseHeaderNilSchema (0.00s)\npanic: runtime error: invalid memory address or nil pointer dereference [recovered, repanicked]\n[signal SIGSEGV: segmentation violation code=0x1 addr=0x20 pc=0x7f6d2a]\n\ngithub.com/getkin/kin-openapi/openapi3filter.decodeValue(...)\n\t/src/openapi3filter/req_resp_decoder.go:273 +0x4a\ngithub.com/getkin/kin-openapi/openapi3filter.validateResponseHeader(...)\n\t/src/openapi3filter/validate_response.go:181 +0x146\ngithub.com/getkin/kin-openapi/openapi3filter.ValidateResponse(...)\n\t/src/openapi3filter/validate_response.go:89 +0xafa\n```\n\nThe `FAIL` is the point: control passes, the header case takes the binary down.\n\nRan in a container against a fresh clone of master. I have not tried it against a live proxy.\n\n## Impact\n\nA process crash instead of an error return. Declaring the header is enough, so it is every call on that operation rather than an occasional one.\n\nIf the spec comes from somewhere else -- gateways, linters, anything ingesting specs it did not write -- that is a trust boundary, and it becomes remote availability.\n\nIf it is your own spec, nothing attacker-controlled starts it, but any client reaching that route then crashes the process. It fires on every call, so normally you would see it the first time that route runs. A spec edited without exercising the route is the case where you would not. That is the difference from GHSA-jpcw, where the attacker supplied the trigger. I have left severity unset; the two cases do not score the same.\n\nOn how common it is, I checked rather than guessed. Of roughly 1,500 OpenAPI 3.x specs on apis.guru, one declares content-typed response headers -- VTEX Catalog API -- and not in one corner of it: the shape repeats across its operations, so for that consumer this is not an edge case.\n\nThe header names in it (`X-AspNet-Version`, `p3p`, a few malformed ones) look like a generator emitting `content` where it could not infer a schema, and apis.guru only indexes public specs. There is no content-typed response header in this repo's testdata either.\n\n## Workarounds\n\nUse `schema` on the response header, or skip `ValidateResponse` for those operations. `ExcludeResponseBody` will not do it -- headers are validated before that check.\n\n## Suggested fix\n\nNil-guard at the top of `decodeValue`:\n\n```go\nif schema == nil {\n\treturn nil, false, nil\n}\n```\n\nReturning nil leaves a `content`-typed header unvalidated rather than erroring, so it trades the crash for a silent gap. An error return kills the panic just as well if you would rather it surfaced.", "title": "osvgo - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/Go%2FGHSA-74vm-87hj-r66f.json?alt=media" }, { "category": "description", "text": "A flaw was found in kin-openapi. This vulnerability allows an attacker to cause a Denial of Service (DoS) by triggering an application crash during response validation. When an OpenAPI specification declares a response header using content rather than a schema, the validation logic attempts to dereference an uninitialized pointer, causing the application to panic and terminate.", "title": "redhat - https://access.redhat.com/errata/RHSA-2026:85266" }, { "category": "other", "text": "0.00472", "title": "EPSS" }, { "category": "other", "text": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "title": "CVSSV4" }, { "category": "other", "text": "8.2", "title": "CVSSV4 base score" }, { "category": "other", "text": "4.2", "title": "NCSC Score" }, { "category": "other", "text": "Is related to CWE-476 (NULL Pointer Dereference), VENDOR FIX as product remediation category", "title": "NCSC Score top increasing factors" }, { "category": "other", "text": "There is product data available from source Debian, There is product_remediation data available from source Redhat", "title": "NCSC Score top decreasing factors" }, { "category": "details", "text": "Severity: 3\n", "title": "Vendor assessment" } ], "product_status": { "fixed": [ "CSAFPID-9764774", "CSAFPID-9821941" ], "known_affected": [ "CSAFPID-6014972", "CSAFPID-8902830", "CSAFPID-8902831", "CSAFPID-9053231", "CSAFPID-9053232", "CSAFPID-9710183", "CSAFPID-8980229", "CSAFPID-9725800", "CSAFPID-3787747", "CSAFPID-3787748", "CSAFPID-3787749", "CSAFPID-3787750", "CSAFPID-3787751", "CSAFPID-3787752", "CSAFPID-3787753", "CSAFPID-3787754", "CSAFPID-3787755", "CSAFPID-3787756", "CSAFPID-3787757", "CSAFPID-3787758", "CSAFPID-3787759", "CSAFPID-3787760", "CSAFPID-3787761", "CSAFPID-3787762", "CSAFPID-3787763", "CSAFPID-3787764", "CSAFPID-3787765", "CSAFPID-3787766", "CSAFPID-3787767", "CSAFPID-3787768", "CSAFPID-3787769", "CSAFPID-3787770", "CSAFPID-3787771", "CSAFPID-3787772", "CSAFPID-3787773", "CSAFPID-3787774", "CSAFPID-3787775", "CSAFPID-3787776", "CSAFPID-3787777", "CSAFPID-3787778", "CSAFPID-3787779", "CSAFPID-3787780", "CSAFPID-3787781", "CSAFPID-3787782", "CSAFPID-8978171", "CSAFPID-8978170", "CSAFPID-8978169", "CSAFPID-8978168", "CSAFPID-8978167", "CSAFPID-8978166", "CSAFPID-8978165", "CSAFPID-8978164", "CSAFPID-8978163", "CSAFPID-3787783", "CSAFPID-8978162", "CSAFPID-8978161", "CSAFPID-8978160", "CSAFPID-8978159", "CSAFPID-9727426", "CSAFPID-9727427", "CSAFPID-3787784", "CSAFPID-3787785", "CSAFPID-3787786", "CSAFPID-3787787", "CSAFPID-3787788", "CSAFPID-3787789", "CSAFPID-3787790", "CSAFPID-3787791", "CSAFPID-3787792", "CSAFPID-3787793", "CSAFPID-3787794", "CSAFPID-3787795", "CSAFPID-3787796", "CSAFPID-3787797", "CSAFPID-3787798", "CSAFPID-3787799", "CSAFPID-3787800", "CSAFPID-3787801", "CSAFPID-3787802", "CSAFPID-3787803", "CSAFPID-3787804", "CSAFPID-3787805", "CSAFPID-3787806", "CSAFPID-3787807", "CSAFPID-3787808", "CSAFPID-3787809", "CSAFPID-3787810", "CSAFPID-3787811", "CSAFPID-3787812", "CSAFPID-3787813", "CSAFPID-3787814", "CSAFPID-3787815", "CSAFPID-3787816", "CSAFPID-3787817", "CSAFPID-3787818", "CSAFPID-3787819", "CSAFPID-3787820", "CSAFPID-3787821", "CSAFPID-3787822", "CSAFPID-3787823", "CSAFPID-3787824", "CSAFPID-3787825", "CSAFPID-3787826", "CSAFPID-3787827", "CSAFPID-3787828", "CSAFPID-3787829", "CSAFPID-3787830", "CSAFPID-3787831", "CSAFPID-3787832", "CSAFPID-3787833", "CSAFPID-3787834", "CSAFPID-3787835", "CSAFPID-3787836", "CSAFPID-3787837", "CSAFPID-3787838", "CSAFPID-3787839", "CSAFPID-3787840", "CSAFPID-3787841", "CSAFPID-3787842", "CSAFPID-3787843", "CSAFPID-3787844", "CSAFPID-3787845", "CSAFPID-3787846", "CSAFPID-3787847", "CSAFPID-3787848", "CSAFPID-3787849", "CSAFPID-3787850", "CSAFPID-3787851", "CSAFPID-3787852", "CSAFPID-3787853", "CSAFPID-3787854", "CSAFPID-3787855", "CSAFPID-3787856", "CSAFPID-3787857", "CSAFPID-3787858", "CSAFPID-3787859", "CSAFPID-3787860", "CSAFPID-3787861", "CSAFPID-3787862", "CSAFPID-3787863", "CSAFPID-3787864", "CSAFPID-3787865", "CSAFPID-3787866", "CSAFPID-3787867", "CSAFPID-3787868", "CSAFPID-3787869", "CSAFPID-3787870", "CSAFPID-3787871", "CSAFPID-3787872", "CSAFPID-3787873", "CSAFPID-3787874", "CSAFPID-3787875", "CSAFPID-3787876", "CSAFPID-3787877", "CSAFPID-3787878", "CSAFPID-3787879", "CSAFPID-3787880", "CSAFPID-9754966" ] }, "references": [ { "category": "external", "summary": "Source - ncscclear", "url": "https://vulnerabilities.ncsc.nl/manual/CVE-2026-100349" }, { "category": "external", "summary": "Source - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-100349" }, { "category": "external", "summary": "Source - nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100349" }, { "category": "external", "summary": "Source - debian", "url": "https://security-tracker.debian.org/tracker/CVE-2026-100349" }, { "category": "external", "summary": "Source - github", "url": "https://github.com/advisories/GHSA-74vm-87hj-r66f" }, { "category": "external", "summary": "Source - cveprojectv5", "url": "https://www.cve.org/CVERecord?id=CVE-2026-100349" }, { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-100349.json?alt=media" }, { "category": "external", "summary": "Source - first", "url": "https://api.first.org/data/v1/epss" }, { "category": "external", "summary": "Source - osvgo", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/Go%2FGHSA-74vm-87hj-r66f.json?alt=media" }, { "category": "external", "summary": "Source - redhat", "url": "https://access.redhat.com/errata/RHSA-2026:85266" }, { "category": "external", "summary": "Source - redhat", "url": "https://access.redhat.com/errata/RHSA-2026:87077" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-100349" }, { "category": "external", "summary": "Reference - redhat", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553589" }, { "category": "external", "summary": "Reference - redhat", "url": "https://www.cve.org/CVERecord?id=CVE-2026-100349" }, { "category": "external", "summary": "Reference - github; osv; osvgo; redhat", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100349" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv; osvgo; redhat", "url": "https://github.com/getkin/kin-openapi/commit/f5441d67f855ed34d975b3b85665764644ab1459" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv; osvgo; redhat", "url": "https://github.com/getkin/kin-openapi/releases/tag/v0.146.0" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv; osvgo; redhat", "url": "https://github.com/getkin/kin-openapi/security/advisories/GHSA-74vm-87hj-r66f" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/errata/RHSA-2026:87077" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-100347" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-100348" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-100351" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-100352" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-100353" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-100354" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-110816" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-15577" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-33374" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-93294" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-95502" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/updates/classification/" }, { "category": "external", "summary": "Reference - redhat", "url": "https://images.redhat.com/" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-92539" }, { "category": "external", "summary": "Reference - redhat", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_87077.json" }, { "category": "external", "summary": "Reference - github", "url": "https://github.com/advisories/GHSA-74vm-87hj-r66f" }, { "category": "external", "summary": "Reference - osv", "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-100349.json" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/errata/RHSA-2026:85266" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-93450" }, { "category": "external", "summary": "Reference - redhat", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_85266.json" } ], "remediations": [ { "category": "vendor_fix", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "product_ids": [ "CSAFPID-9764774" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:85266" }, { "category": "vendor_fix", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/", "product_ids": [ "CSAFPID-9821941" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:87077" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-3787747", "CSAFPID-3787748", "CSAFPID-3787749", "CSAFPID-3787750", "CSAFPID-3787751", "CSAFPID-3787752", "CSAFPID-3787753", "CSAFPID-3787754", "CSAFPID-3787755", "CSAFPID-3787756", "CSAFPID-3787757", "CSAFPID-3787758", "CSAFPID-3787759", "CSAFPID-3787760", "CSAFPID-3787761", "CSAFPID-3787762", "CSAFPID-3787763", "CSAFPID-3787764", "CSAFPID-3787765", "CSAFPID-3787766", "CSAFPID-3787767", "CSAFPID-3787768", "CSAFPID-3787769", "CSAFPID-3787770", "CSAFPID-3787771", "CSAFPID-3787772", "CSAFPID-3787773", "CSAFPID-3787774", "CSAFPID-3787775", "CSAFPID-3787776", "CSAFPID-3787777", "CSAFPID-3787778", "CSAFPID-3787779", "CSAFPID-3787780", "CSAFPID-3787781", "CSAFPID-3787782", "CSAFPID-3787783", "CSAFPID-3787784", "CSAFPID-3787785", "CSAFPID-3787786", "CSAFPID-3787787", "CSAFPID-3787788", "CSAFPID-3787789", "CSAFPID-3787790", "CSAFPID-3787791", "CSAFPID-3787792", "CSAFPID-3787793", "CSAFPID-3787794", "CSAFPID-3787795", "CSAFPID-3787796", "CSAFPID-3787797", "CSAFPID-3787798", "CSAFPID-3787799", "CSAFPID-3787800", "CSAFPID-3787801", "CSAFPID-3787802", "CSAFPID-3787803", "CSAFPID-3787804", "CSAFPID-3787805", "CSAFPID-3787806", "CSAFPID-3787807", "CSAFPID-3787808", "CSAFPID-3787809", "CSAFPID-3787810", "CSAFPID-3787811", "CSAFPID-3787812", "CSAFPID-3787813", "CSAFPID-3787814", "CSAFPID-3787815", "CSAFPID-3787816", "CSAFPID-3787817", "CSAFPID-3787818", "CSAFPID-3787819", "CSAFPID-3787820", "CSAFPID-3787821", "CSAFPID-3787822", "CSAFPID-3787823", "CSAFPID-3787824", "CSAFPID-3787825", "CSAFPID-3787826", "CSAFPID-3787827", "CSAFPID-3787828", "CSAFPID-3787829", "CSAFPID-3787830", "CSAFPID-3787831", "CSAFPID-3787832", "CSAFPID-3787833", "CSAFPID-3787834", "CSAFPID-3787835", "CSAFPID-3787836", "CSAFPID-3787837", "CSAFPID-3787838", "CSAFPID-3787839", "CSAFPID-3787840", "CSAFPID-3787841", "CSAFPID-3787842", "CSAFPID-3787843", "CSAFPID-3787844", "CSAFPID-3787845", "CSAFPID-3787846", "CSAFPID-3787847", "CSAFPID-3787848", "CSAFPID-3787849", "CSAFPID-3787850", "CSAFPID-3787851", "CSAFPID-3787852", "CSAFPID-3787853", "CSAFPID-3787854", "CSAFPID-3787855", "CSAFPID-3787856", "CSAFPID-3787857", "CSAFPID-3787858", "CSAFPID-3787859", "CSAFPID-3787860", "CSAFPID-3787861", "CSAFPID-3787862", "CSAFPID-3787863", "CSAFPID-3787864", "CSAFPID-3787865", "CSAFPID-3787866", "CSAFPID-3787867", "CSAFPID-3787868", "CSAFPID-3787869", "CSAFPID-3787870", "CSAFPID-3787871", "CSAFPID-3787872", "CSAFPID-3787873", "CSAFPID-3787874", "CSAFPID-3787875", "CSAFPID-3787876", "CSAFPID-3787877", "CSAFPID-3787878", "CSAFPID-3787879", "CSAFPID-3787880", "CSAFPID-6014972", "CSAFPID-8902830", "CSAFPID-8902831", "CSAFPID-8978159", "CSAFPID-8978160", "CSAFPID-8978161", "CSAFPID-8978162", "CSAFPID-8978163", "CSAFPID-8978164", "CSAFPID-8978165", "CSAFPID-8978166", "CSAFPID-8978167", "CSAFPID-8978168", "CSAFPID-8978169", "CSAFPID-8978170", "CSAFPID-8978171", "CSAFPID-8980229", "CSAFPID-9053231", "CSAFPID-9053232", "CSAFPID-9710183", "CSAFPID-9725800", "CSAFPID-9727426", "CSAFPID-9727427", "CSAFPID-9754966" ] } ], "title": "CVE-2026-100349" } ] }