kin-openapi openapi3filter: unauthenticated nil-pointer panic when validating a request against a `content` parameter whose media type has no schema

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-73502 · Microsoft / collected KEV context

EUVD-2026-61142

GHSA-jpcw-4wr7-c3vq

GO-2026-6112

cve-program · CVE-2026-73502

• https://github.com/getkin/kin-openapi/security/advisories/GHSA-jpcw-4wr7-c3vq
• https://github.com/getkin/kin-openapi/commit/68ac2affa325514d7d6e731204d6a1edf6bdff64
• https://github.com/getkin/kin-openapi/releases/tag/v0.144.0

euvd · EUVD-2026-61142

• https://github.com/getkin/kin-openapi/security/advisories/GHSA-jpcw-4wr7-c3vq
• https://github.com/getkin/kin-openapi/commit/68ac2affa325514d7d6e731204d6a1edf6bdff64
• https://github.com/getkin/kin-openapi/releases/tag/v0.144.0

nvd · CVE-2026-73502

• https://github.com/getkin/kin-openapi/commit/68ac2affa325514d7d6e731204d6a1edf6bdff64
• https://github.com/getkin/kin-openapi/releases/tag/v0.144.0
• https://github.com/getkin/kin-openapi/security/advisories/GHSA-jpcw-4wr7-c3vq

osv · GHSA-jpcw-4wr7-c3vq

• https://github.com/getkin/kin-openapi/security/advisories/GHSA-jpcw-4wr7-c3vq
• https://github.com/getkin/kin-openapi/commit/68ac2affa325514d7d6e731204d6a1edf6bdff64
• https://github.com/getkin/kin-openapi
• https://github.com/getkin/kin-openapi/releases/tag/v0.144.0

osv · GO-2026-6112

• https://github.com/getkin/kin-openapi/security/advisories/GHSA-jpcw-4wr7-c3vq
• https://github.com/getkin/kin-openapi/commit/68ac2affa325514d7d6e731204d6a1edf6bdff64
• https://github.com/getkin/kin-openapi/releases/tag/v0.144.0

• kin-openapi is a Go project for handling OpenAPI files. From 0.2.0 until 0.144.0, openapi3filter.ValidateRequest can encounter a NULL-pointer-dereference denial of service when an operation declares a content parameter whose application/jso… · Advisory content revised · 7 Nov 2026