Answer in brief
CVE-2026-73502 records a Medium severity (CVSS 5.3) vulnerability in kin-openapi openapi3filter: unauthenticated nil-pointer panic when validating a request against a `content` parameter whose media type has no schema. The current sources do not mark it as known exploited. The current feed maps getkin/kin-openapi (generic), github.com/getkin/kin-openapi (go), github.com/getkin/kin-openapi (go). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
Answer in brief
CVE-2026-73502 records a Medium severity (CVSS 5.3) vulnerability in kin-openapi openapi3filter: unauthenticated nil-pointer panic when validating a request against a `content` parameter whose media type has no schema. The current sources do not mark it as known exploited. The current feed maps getkin/kin-openapi (generic), github.com/getkin/kin-openapi (go), github.com/getkin/kin-openapi (go). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps getkin/kin-openapi (generic), github.com/getkin/kin-openapi (go), github.com/getkin/kin-openapi (go). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| getkin/kin-openapigeneric | >= 0.2.0, < 0.144.0 | Not reported |
| github.com/getkin/kin-openapigo | >=0 <0.144.0 | 0.144.0 |
| github.com/getkin/kin-openapigo | <=0.143.0 | 0.144.0 |
Published upstream
Aug 18, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 18, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 8, 2026
kin-openapi is a Go project for handling OpenAPI files. From 0.2.0 until 0.144.0, openapi3filter.ValidateRequest can encounter a NULL-pointer-dereference denial of service when an operation declares a content parameter whose application/json media type has no schema. In openapi3filter/req_resp_decoder.go, the default defaultContentParameterDecoder dereferences mt.Schema.Value without checking whether mt.Schema is nil, even though doc.Validate() accepts the document under OpenAPI 3.0.x and 3.1.x. A single unauthenticated request supplying the parameter value can panic request validation, causing an aborted request with log growth in the common synchronous net/http path or a full process crash in integrations without recovery. This issue is fixed in version 0.144.0.
Quoted source text, attributed separately from HOL analysis.
CVSS is 5.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps getkin/kin-openapi (generic), github.com/getkin/kin-openapi (go), github.com/getkin/kin-openapi (go). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| getkin/kin-openapigeneric | >= 0.2.0, < 0.144.0 | Not reported |
| github.com/getkin/kin-openapigo | >=0 <0.144.0 | 0.144.0 |
| github.com/getkin/kin-openapigo | <=0.143.0 | 0.144.0 |
Published upstream
Aug 18, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 18, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 8, 2026
kin-openapi is a Go project for handling OpenAPI files. From 0.2.0 until 0.144.0, openapi3filter.ValidateRequest can encounter a NULL-pointer-dereference denial of service when an operation declares a content parameter whose application/json media type has no schema. In openapi3filter/req_resp_decoder.go, the default defaultContentParameterDecoder dereferences mt.Schema.Value without checking whether mt.Schema is nil, even though doc.Validate() accepts the document under OpenAPI 3.0.x and 3.1.x. A single unauthenticated request supplying the parameter value can panic request validation, causing an aborted request with log growth in the common synchronous net/http path or a full process crash in integrations without recovery. This issue is fixed in version 0.144.0.
Quoted source text, attributed separately from HOL analysis.