The vulnerability in kin-openapi allows a nil pointer dereference when the loader resolves a self‑referential $ref inside additionalProperties. If an attacker supplies an OpenAPI document that references its own additionalProperties member, the loader will panic during the resolveComponent step, aborting the loading process. This constitutes a denial‑of‑service condition, classified as CWE‑476.

The issue affects the getkin kin-openapi library for all releases prior to 0.145.0. Any installation of kin‑openapi that uses the openapi3.Loader to load specifications from an external source remains vulnerable.

The CVSS score of 5.3 indicates medium severity. The EPSS score of less than 1% suggests a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The problem is triggered when an application that uses kin-openapi’s Loader processes a maliciously crafted OpenAPI document containing a self‑referential $ref within additionalProperties. The likely attack vector is an application that loads OpenAPI specifications from an external or untrusted source. If such a document reaches the resolveComponent step, the loader will panic, terminating the process and causing a denial of service.