A circular reference within an OpenAPI document triggers a stack overflow in the OpenAPI.NET SDK, terminating the process that parses the document. This leads to a denial of service by crashing the application that relies on OpenAPI.NET. The flaw is an uncontrolled recursion flaw (CWE‑674).

Microsoft OpenAPI.NET SDK is impacted. Versions from 2.0.0‑preview11 up through 2.7.5, and the 3.x line up to 3.5.4 are vulnerable. The vulnerability is fixed in 2.7.5 and 3.5.4 and any later releases.

The CVSS score of 7.5 reflects high severity. EPSS data is unavailable, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires that the target application use OpenAPI.NET to parse a supplied OpenAPI document; an attacker can supply a payload containing a circular schema reference. The attack does not require authentication or network access beyond the ability to deliver the document, and it causes a local denial of service by bringing the process crashing. Because the flaw stems from parsing logic, it is unlikely to escape beyond the affected process.