News KrakenD 3.0 Is Here: AI Router, Semantic Cache, and On-the-Fly Stream Manipulation News KrakenD CE 3.0.2, EE 3.0.2 and EE 2.13.12 Update Released News KrakenD CE 3.0.1, EE 3.0.1 and EE 2.13.11 Update Released News KrakenD Partners with CGK Solutions to Secure API Integration in Italy

CVE-2026-100349 CVE High · CVSS 8.2 False Positive

kin-openapi: Nil Pointer Panic in ValidateResponse on Headers Declared with Content

This advisory does not affect KrakenD

The panic requires validating backend responses with openapi3filter.ValidateResponse. KrakenD Enterprise uses kin-openapi only to load and translate OpenAPI documents in the krakend openapi commands and never validates responses against an OpenAPI specification. KrakenD Community does not include kin-openapi.

Addressed through routine dependency maintenance in EE 3.0.2, 2.13.12.

Component

kin-openapi (openapi3filter)

Disclosed

Oct 20, 2026

CVSS Score

8.2

Description

Before kin-openapi 0.146.0, openapi3filter.ValidateResponse passes a nil header schema to decodeValue when an OpenAPI document declares a response header with content instead of schema. The document passes validation, but every response validation for the affected operation panics, even when the response does not carry the header. Applications ingesting untrusted specifications expose this as a remote availability issue.

References

View CVE-2026-100349 on NVD View CVE-2026-100349 on GitHub Advisory Database

Stay up to date with KrakenD releases and important updates