Description
The OpenAPI.NET SDK contains a useful object model for OpenAPI documents in .NET along with common serializers to extract raw OpenAPI JSON and YAML documents from the model. In Microsoft.OpenApi.Readers versions before 1.6.30 and Microsoft.OpenApi.YamlReader from 2.0.0-preview.11 through 2.11.0 and 3.0.0 through 3.9.0, parsing a YAML OpenAPI document with nested anchors and aliases can consume uncontrolled memory. SharpYaml represents aliases as shared nodes in a small directed acyclic graph, but conversion to independent OpenAPI or System.Text.Json.Nodes.JsonNode trees duplicates every aliased path; without a node-count or nesting-depth limit, N nested anchors referenced k times can require k^N materialized nodes and terminate the process through an out-of-memory condition. The fixed readers bound materialization to 5,000,000 nodes and a nesting depth of 64 by default and report an OpenApiDiagnostic error when a limit is exceeded. This vulnerability is fixed in Microsoft.OpenApi.Readers 1.6.30 and Microsoft.OpenApi.YamlReader 2.12.0 and 3.10.0.
Published: 2026-09-08
Score: 7.5 High
EPSS: 1.9% Low
KEV: No
Impact: Denial of Service
Action: Immediate Patch
AI Analysis

Impact

Parsing a YAML OpenAPI document that contains nested anchors and aliases can trigger uncontrollable memory usage in Microsoft.OpenApi.YamlReader. The affected library loads the YAML into a directed acyclic graph via SharpYaml, then converts it to System.Text.Json.Nodes.JsonNode, duplicating each alias as an independent node. Because no bounding on node count or nesting depth is enforced, a maliciously crafted document with multiple nested anchors each referenced many times can create exponential numbers of materialized nodes, exhausting the process's memory and causing an out‑of‑memory crash—a denial‑of‑service condition. The vulnerability has been corrected by imposing a default limit of 5 000 000 nodes and a nesting depth of 64, with an OpenApiDiagnostic error raised when thresholds are exceeded.

Affected Systems

The vulnerability affects Microsoft.OpenApi.YamlReader versions from 2.0.0‑preview.11 up through 2.11.x and from 3.0.0 through 3.9.x, as well as Microsoft.OpenApi.Readers versions prior to 1.6.30. The issue is resolved in Microsoft.OpenApi.YamlReader 2.12.0 and 3.10.0, and Microsoft.OpenApi.Readers 1.6.30 and later.

Risk and Exploitability

The CVSS score of 7.5 indicates a high‑impact denial of service, while the EPSS score of 1% suggests a modest likelihood of exploitation and the vulnerability is not present in the CISA KEV catalog. Based on the description, it is inferred that no authentication is required; any component that accepts user‑supplied OpenAPI definitions is at risk. The likely attack vector involves an attacker providing a malicious OpenAPI document via file upload, API consumption, or other means of influencing the parser, which can be executed remotely as long as the application processes user input.

Generated by OpenCVE AI on October 17, 2026 at 09:31 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Microsoft.OpenApi.YamlReader to version 2.12.0 or later or to 3.10.0 or later, and upgrade Microsoft.OpenApi.Readers to 1.6.30 or later.
  • If an upgrade is not immediately possible, enforce strict validation or sanitation of incoming OpenAPI files to limit or reject nested anchors and aliases before they reach the parser.
  • Deploy application‑level resource controls such as memory limits, container quotas, or OS‑level cgroups to mitigate the impact of potential memory exhaustion attacks.

Generated by OpenCVE AI on October 17, 2026 at 09:31 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-7pxr-59rr-hqj2 Microsoft.OpenApi.YamlReader vulnerable to denial of service via YAML alias expansion
History

Wed, 14 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Description In Microsoft.OpenApi.YamlReader from 2.0.0-preview.11 until 2.12.0 and from 3.0.0 until 3.10.0, and in Microsoft.OpenApi.Readers prior to 1.6.30, a small YAML OpenAPI document containing nested anchors and aliases can cause uncontrolled resource consumption when parsed through the public YAML reader APIs. YAML is parsed through SharpYaml, which represents aliases as shared nodes in a directed acyclic graph, so the parsed YAML graph stays small, but converting that graph to System.Text.Json.Nodes.JsonNode requires every alias to be materialized as an independent node because a JsonNode cannot be attached to multiple parents. Without a bound on that conversion work, a document with N nested anchors each referenced k times can require k^N materialized JSON nodes, leading to excessive memory allocation and process termination through out-of-memory conditions, a billion laughs style denial of service. The patched versions bound the YAML-to-JSON conversion by node count and nesting depth and report an OpenApiDiagnostic error instead of expanding without limit. This vulnerability is fixed in Microsoft.OpenApi.YamlReader 2.12.0 and 3.10.0, and Microsoft.OpenApi.Readers 1.6.30. The OpenAPI.NET SDK contains a useful object model for OpenAPI documents in .NET along with common serializers to extract raw OpenAPI JSON and YAML documents from the model. In Microsoft.OpenApi.Readers versions before 1.6.30 and Microsoft.OpenApi.YamlReader from 2.0.0-preview.11 through 2.11.0 and 3.0.0 through 3.9.0, parsing a YAML OpenAPI document with nested anchors and aliases can consume uncontrolled memory. SharpYaml represents aliases as shared nodes in a small directed acyclic graph, but conversion to independent OpenAPI or System.Text.Json.Nodes.JsonNode trees duplicates every aliased path; without a node-count or nesting-depth limit, N nested anchors referenced k times can require k^N materialized nodes and terminate the process through an out-of-memory condition. The fixed readers bound materialization to 5,000,000 nodes and a nesting depth of 64 by default and report an OpenApiDiagnostic error when a limit is exceeded. This vulnerability is fixed in Microsoft.OpenApi.Readers 1.6.30 and Microsoft.OpenApi.YamlReader 2.12.0 and 3.10.0.
Title Microsoft.OpenApi.YamlReader/Readers vulnerable to denial of service via YAML alias expansion Microsoft.OpenApi.YamlReader vulnerable to denial of service via YAML alias expansion
References

Tue, 08 Sep 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Microsoft
Microsoft openapi.readers
Microsoft openapi.yamlreader
Vendors & Products Microsoft
Microsoft openapi.readers
Microsoft openapi.yamlreader

Tue, 08 Sep 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 08 Sep 2026 18:00:00 +0000

Type Values Removed Values Added
Description In Microsoft.OpenApi.YamlReader from 2.0.0-preview.11 until 2.12.2 and from 3.0.0 until 3.10.2, and in Microsoft.OpenApi.Readers prior to 1.6.31, a small YAML OpenAPI document containing nested anchors and aliases can cause uncontrolled resource consumption when parsed through the public YAML reader APIs. YAML is parsed through SharpYaml, which represents aliases as shared nodes in a directed acyclic graph, so the parsed YAML graph stays small, but converting that graph to System.Text.Json.Nodes.JsonNode requires every alias to be materialized as an independent node because a JsonNode cannot be attached to multiple parents. Without a bound on that conversion work, a document with N nested anchors each referenced k times can require k^N materialized JSON nodes, leading to excessive memory allocation and process termination through out-of-memory conditions, a billion laughs style denial of service. The patched versions bound the YAML-to-JSON conversion by node count and nesting depth and report an OpenApiDiagnostic error instead of expanding without limit. This vulnerability is fixed in Microsoft.OpenApi.YamlReader 2.12.2 and 3.10.2, and Microsoft.OpenApi.Readers 1.6.31. In Microsoft.OpenApi.YamlReader from 2.0.0-preview.11 until 2.12.0 and from 3.0.0 until 3.10.0, and in Microsoft.OpenApi.Readers prior to 1.6.30, a small YAML OpenAPI document containing nested anchors and aliases can cause uncontrolled resource consumption when parsed through the public YAML reader APIs. YAML is parsed through SharpYaml, which represents aliases as shared nodes in a directed acyclic graph, so the parsed YAML graph stays small, but converting that graph to System.Text.Json.Nodes.JsonNode requires every alias to be materialized as an independent node because a JsonNode cannot be attached to multiple parents. Without a bound on that conversion work, a document with N nested anchors each referenced k times can require k^N materialized JSON nodes, leading to excessive memory allocation and process termination through out-of-memory conditions, a billion laughs style denial of service. The patched versions bound the YAML-to-JSON conversion by node count and nesting depth and report an OpenApiDiagnostic error instead of expanding without limit. This vulnerability is fixed in Microsoft.OpenApi.YamlReader 2.12.0 and 3.10.0, and Microsoft.OpenApi.Readers 1.6.30.

Tue, 08 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Description In Microsoft.OpenApi.YamlReader from 2.0.0-preview.11 until 2.12.2 and from 3.0.0 until 3.10.2, and in Microsoft.OpenApi.Readers prior to 1.6.31, a small YAML OpenAPI document containing nested anchors and aliases can cause uncontrolled resource consumption when parsed through the public YAML reader APIs. YAML is parsed through SharpYaml, which represents aliases as shared nodes in a directed acyclic graph, so the parsed YAML graph stays small, but converting that graph to System.Text.Json.Nodes.JsonNode requires every alias to be materialized as an independent node because a JsonNode cannot be attached to multiple parents. Without a bound on that conversion work, a document with N nested anchors each referenced k times can require k^N materialized JSON nodes, leading to excessive memory allocation and process termination through out-of-memory conditions, a billion laughs style denial of service. The patched versions bound the YAML-to-JSON conversion by node count and nesting depth and report an OpenApiDiagnostic error instead of expanding without limit. This vulnerability is fixed in Microsoft.OpenApi.YamlReader 2.12.2 and 3.10.2, and Microsoft.OpenApi.Readers 1.6.31.
Title Microsoft.OpenApi.YamlReader/Readers vulnerable to denial of service via YAML alias expansion
Weaknesses CWE-400
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Microsoft Openapi.readers Openapi.yamlreader
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-14T20:08:53.059Z

Reserved: 2026-08-10T17:57:26.144Z

Link: CVE-2026-72923

cve-icon Vulnrichment

Updated: 2026-09-08T17:37:08.978Z

cve-icon NVD

Status : Deferred

Published: 2026-09-08T18:20:16.310

Modified: 2026-10-14T21:17:39.323

Link: CVE-2026-72923

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-17T09:45:06Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption