It would certainly be irresponsible.

The responsible thing would have been to simply wait another month, considering you've been warned about the delay.

the vulnerability is there whether disclosed or not. if you find it, someone else has too. sitting on it is the irresponsible thing.