A nil-pointer dereference occurs in the error‑encoding logic of a server that uses the kin‑openapi library when it processes a malformed multipart/form‑data request. The library’s ConvertErrors helper attempts to read a request parameter that the inner error structure does not supply, causing a panic. The resulting crash terminates the handler, exhausting available worker threads or processes until the application is restarted, which is a classic unavailability attack.

The vulnerability is limited to applications that include kin‑openapi version 0.10.0 through 0.140.9 and that explicitly use the ConvertErrors or ValidationErrorEncoder functions to render validation errors. Systems running earlier or later releases, or bypassing these helper functions, are not affected. The library is used primarily in Go‑based web services that expose OpenAPI definitions via HTTP endpoints.

The CVSS base score of 7.5 indicates a high impact; the vulnerability can be triggered over the network by any client without authentication, as long as the target service accepts multipart/form‑data requests. No exploit code is required beyond crafting an invalid request body containing a non‑string scalar field. Because the EPSS metric is unavailable, the current data does not quantify how frequently attackers target this weakness, but the high severity and lack of mitigation on affected deployments make it a compelling target. The vulnerability is not yet listed in the CISA KEV catalog.