CVE-2026-100349

## Summary `ValidateResponse` panics on a nil pointer when a spec declares a response header with `content` instead of `schema`. `doc.Validate()` accepts that document, so the crash comes from a spec the library just called valid. Same class as GHSA-jpcw-4wr7-c3vq, which covered the request-parameter case in v0.144.0; this is the response-header path. Affects `github.com/getkin/kin-openapi` `<= v0.145.0`. Reproduced on master `947498e5a6bd`, Go 1.26. ## Details A `content`-typed response header has `headerRef.Value.Schema == nil`. `validate_response.go:181` passes it straight through: ```go if decodedValue, found, err = decodeValue(dec, headerName, sm, headerRef.Value.Schema, headerRef.Value.Required); err != nil { ``` and `req_resp_decoder.go:273` is where it lands: ```go if len(schema.Value.AllOf) > 0 { ``` Two things I checked rather than assumed. The response does not need to carry the header; declaring it is enough, and then every call for that operation panics. And the body path is fine, `:114` returns early on a nil schema, so this is headers only. The PoC keeps the body case as a control. ## PoC Drop into `openapi3filter/` and run: ``` go test ./openapi3filter/ -run NilSchema -v ``` ```go package openapi3filter_test import ( "context" "io" "net/http" "net/http/httptest" "strings" "testing" "github.com/getkin/kin-openapi/openapi3" "github.com/getkin/kin-openapi/openapi3filter" "github.com/getkin/kin-openapi/routers" ) const specBody = ` openapi: 3.0.3 info: {title: poc, version: "1.0.0"} paths: /x: get: responses: "200": description: ok content: application/json: {} ` const specHeader = ` openapi: 3.0.3 info: {title: poc, version: "1.0.0"} paths: /x: get: responses: "200": description: ok headers: X-Thing: content: application/json: {} ` func validatedInput(t *testing.T, spec string, hdr http.Header)