A nil-pointer dereference in the openapi3filter package of the kin-openapi library occurs when a Go application processes OpenAPI 3.1 array schemas that miss an "items" keyword. During request or response validation of application/x-www-form-urlencoded or multipart/form-data payloads, the library dereferences a nil Schema.Items pointer, causing a panic and terminating the process. The vulnerability is triggered by a remote unauthenticated client that can send a nonempty request or matching response to an affected operation, leading to a deterministic crash.

The issue affects the Go library kin-openapi, version 0.136.0 through 0.142.x – any application that imports the library in that range and validates OpenAPI 3.1 schemas containing array parameters without an "items" definition.

The CVSS score of 7.5 indicates high severity, but the EPSS score of less than 1% suggests exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog. An attacker can exploit the flaw by sending crafted requests to any public endpoint that processes OpenAPI 3.1 schemas with malformed array definitions, leading to an application crash. The problem requires no privilege escalation and can be triggered remotely without authentication.