The vulnerability is a nil-pointer dereference in kin-openapi's openapi3filter.ValidateResponse. When an OpenAPI document declares a response header with content instead of a schema, the validation routine passes a nil schema to decodeValue, causing a panic that crashes the application during response validation, even if the header is absent. The flaw does not modify the response data itself, but it results in a loss of availability whenever the affected operation is exercised.

The issue impacts the getkin:kin-openapi library, affecting all releases prior to version 0.146.0.

The CVSS score of 8.2 signals a high severity problem. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, but the potential impact remains significant. Based on the description, it is inferred that an attacker can supply a malicious OpenAPI specification that includes a response header declared with content. The resulting nil-pointer panic causes the application to crash, providing a remote denial-of-service condition. Exploitation requires the ability to insert or alter the OpenAPI document processed by the application.