CVE-2026-73502

A flaw was found in kin-openapi. An unauthenticated remote attacker can trigger a null-pointer dereference in the openapi3filter.ValidateRequest function. This occurs when validating a request against a content parameter whose application/json media type has no schema. Successful exploitation leads to a denial of service, causing request validation to panic and potentially resulting in an aborted request or a full process crash.

Red Hat rates this flaw as Moderate severity because in Go services built on the standard net/http server — which includes all affected Red Hat products — panics inside HTTP handlers are recovered automatically per-goroutine. Only the individual request fails; the service continues to serve subsequent requests without data loss or state corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

As a partial workaround, administrators can audit their OpenAPI specification files and ensure every content parameter declares an explicit schema for each media type, which prevents the nil-dereference code path from being reached.