A nil pointer dereference in the openapi3filter.ValidateRequest routine causes a panic when an OpenAPI operation declares a content parameter whose application/json media type has no schema. The panic aborts the current request, can overwhelm logs in the synchronous net/http path, and may crash the entire process in applications that lack panic recovery. The result is a denial of service that a malicious actor can trigger with a single unauthenticated request containing such a parameter value.

The vulnerability affects the Go library getkin/kin-openapi, specifically the openapi3filter component. All releases from version 0.2.0 up to but excluding 0.144.0 are susceptible. Projects that import this library to validate OpenAPI requests, including microservices and API gateways that rely on kin-openapi, must review the versions they use.

The CVSS score of 5.3 indicates a moderate severity risk. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, yet the flaw can be exploited by any unauthenticated client that submits a normal HTTP request containing an application/json content parameter without a schema. The attacker does not need special privileges or authentication, and the side effect can be immediate termination of the service or a disruptive log growth, making it a practical threat for exposed APIs.