kin-openapi is a Go project for handling OpenAPI files. Prior to 0.146.0, openapi3filter.ValidateResponse passes a nil response header schema to decodeValue when an OpenAPI document declares the header with content instead of schema. The document passes validation, but every response validation for the affected operation dereferences the nil schema and panics even when the response does not contain the declared header. Applications that ingest an untrusted specification can expose this as remote availability impact, while applications using only trusted local specifications still crash when the affected operation is exercised. This issue is fixed in version 0.146.0.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - kin-openapi is a Go project for handling OpenAPI files. Prior to 0.146.0, openapi3filter.ValidateResponse
    passes a nil response header schema to decodeValue when an OpenAPI document declares the header with
    content instead of schema. The document passes validation, but every response validation for the affected
    operation dereferences the nil schema and panics even when the response does not contain the declared
    header. Applications that ingest an untrusted specification can expose this as remote availability impact,
    while applications using only trusted local specifications still crash when the affected operation is
    exercised. This issue is fixed in version 0.146.0. (CVE-2026-100349)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - kin-openapi is a Go project for handling OpenAPI files. Prior to 0.146.0, openapi3filter.ValidateResponse     passes a nil response header schema to decodeValue when an OpenAPI document declares the header with     content instead of schema. The document passes validation, but every response validation for the affected     operation dereferences the nil schema and panics even when the response does not contain the declared     header. Applications that ingest an untrusted specification can expose this as remote availability impact,     while applications using only trusted local specifications still crash when the affected operation is     exercised. This issue is fixed in version 0.146.0. (CVE-2026-100349)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
476162	Chainguard: crossplane-provider-aws-autoscaling-fips: security update to 2.9.0-r4	Tenable Cloud Security	Chainguard Local Security Checks	Local	high
476162	Chainguard: crossplane-provider-aws-autoscaling-fips: security update to 2.9.0-r4	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	high
476090	SCA: security update for github.com/getkin/kin-openapi (GHSA-74vm-87hj-r66f)	Tenable Cloud Security	SCA Checks	Local	high
476090	SCA: security update for github.com/getkin/kin-openapi (GHSA-74vm-87hj-r66f)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
366485	Linux Distros Unpatched Vulnerability : CVE-2026-100349	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-100349

high

Tenable Plugins

high

high

high

high

high