Read the docs
TI-2026-51139 Aliases CVE-2026-72923GHSA-7pxr-59rr-hqj2

Microsoft.OpenApi.YamlReader vulnerable to denial of service via YAML alias expansion

Priority MEDIUM 43CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

The OpenAPI.NET SDK contains a useful object model for OpenAPI documents in .NET along with common serializers to extract raw OpenAPI JSON and YAML documents from the model. In Microsoft.OpenApi.Readers versions before 1.6.30 and Microsoft.OpenApi.YamlReader from 2.0.0-preview.11 through 2.11.0 and 3.0.0 through 3.9.0, parsing a YAML OpenAPI document with nested anchors and aliases can consume uncontrolled memory. SharpYaml represents aliases as shared nodes in a small directed acyclic graph, but conversion to independent OpenAPI or System.Text.Json.Nodes.JsonNode trees duplicates every aliased path; without a node-count or nesting-depth limit, N nested anchors referenced k times can require k^N materialized nodes and terminate the process through an out-of-memory condition. The fixed readers bound materialization to 5,000,000 nodes and a nesting depth of 64 by default and report an OpenApiDiagnostic error when a limit is exceeded. This vulnerability is fixed in Microsoft.OpenApi.Readers 1.6.30 and Microsoft.OpenApi.YamlReader 2.12.0 and 3.10.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01845 79th percentileScored 2026-11-07
Fix Fixed OpenAPI.NET (microsoft): 3.10.0, 2.12.0, 1.6.30Microsoft.OpenApi.YamlReader (NuGet): 3.10.0, 2.12.0+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftOpenAPI.NET3.0.0 to before 3.10.0; 2.0.0-preview.11 to before 2.12.0; before 1.6.303.10.0, 2.12.0, 1.6.30Patch availableCNA
—Microsoft.OpenApi.YamlReader (NuGet)3.0.0 to before 3.10.03.10.0Patch availableGHSA-7pxr-59rr-hqj2
—Microsoft.OpenApi.YamlReader (NuGet)2.0.0-preview.11 to before 2.12.02.12.0Patch availableGHSA-7pxr-59rr-hqj2
—Microsoft.OpenApi.Readers (NuGet)before 1.6.301.6.30Patch availableGHSA-7pxr-59rr-hqj2
  • OpenAPI.NET VendorMicrosoft Affected 3.0.0 to before 3.10.0; 2.0.0-preview.11 to before 2.12.0; before 1.6.30 Fixed in 3.10.0, 2.12.0, 1.6.30 Patch available CNA
  • Microsoft.OpenApi.YamlReader (NuGet) Vendor— Affected 3.0.0 to before 3.10.0 Fixed in 3.10.0 Patch available GHSA-7pxr-59rr-hqj2
  • Microsoft.OpenApi.YamlReader (NuGet) Vendor— Affected 2.0.0-preview.11 to before 2.12.0 Fixed in 2.12.0 Patch available GHSA-7pxr-59rr-hqj2
  • Microsoft.OpenApi.Readers (NuGet) Vendor— Affected before 1.6.30 Fixed in 1.6.30 Patch available GHSA-7pxr-59rr-hqj2

Remediation

  • Fix · CNA OpenAPI.NET (microsoft) Fixed in 3.10.0, 2.12.0, 1.6.30
  • Fix · GHSA-7pxr-59rr-hqj2 Microsoft.OpenApi.YamlReader (NuGet) Fixed in 3.10.0 Advisory →
  • Fix · GHSA-7pxr-59rr-hqj2 Microsoft.OpenApi.YamlReader (NuGet) Fixed in 2.12.0 Advisory →
  • Fix · GHSA-7pxr-59rr-hqj2 Microsoft.OpenApi.Readers (NuGet) Fixed in 1.6.30 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-72923
  2. 2026-10-15 Alias added: GHSA-7pxr-59rr-hqj2
  3. 2026-10-15 Fix available: NuGet/[email protected], NuGet/[email protected], NuGet/[email protected] · GHSA-7pxr-59rr-hqj2
  4. 2026-10-15 CVSS score added · GHSA-7pxr-59rr-hqj2
  5. 2026-10-15 Weakness changed · GHSA-7pxr-59rr-hqj2
  6. 2026-10-15 12 new references · GHSA-7pxr-59rr-hqj2
  7. 2026-10-15 Title updated · CNA
  8. 2026-10-15 Affected versions changed · CNA
  9. 2026-10-15 3 new references · CNA

References

Advisory 1

Other 11

  • TI-2026-42212 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-37256 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-26194 Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-16982 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-36863 Windows Server Update Service (WSUS) Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-33671 Microsoft SharePoint Server Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
See all 18045 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences