Description
In Microsoft.OpenApi.YamlReader from 2.0.0-preview.11 until 2.12.0 and from 3.0.0 until 3.10.0, and in Microsoft.OpenApi.Readers prior to 1.6.30, a small YAML OpenAPI document containing nested anchors and aliases can cause uncontrolled resource consumption when parsed through the public YAML reader APIs. YAML is parsed through SharpYaml, which represents aliases as shared nodes in a directed acyclic graph, so the parsed YAML graph stays small, but converting that graph to System.Text.Json.Nodes.JsonNode requires every alias to be materialized as an independent node because a JsonNode cannot be attached to multiple parents. Without a bound on that conversion work, a document with N nested anchors each referenced k times can require k^N materialized JSON nodes, leading to excessive memory allocation and process termination through out-of-memory conditions, a billion laughs style denial of service. The patched versions bound the YAML-to-JSON conversion by node count and nesting depth and report an OpenApiDiagnostic error instead of expanding without limit. This vulnerability is fixed in Microsoft.OpenApi.YamlReader 2.12.0 and 3.10.0, and Microsoft.OpenApi.Readers 1.6.30.
Published: 2026-09-08
Score: 7.5 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability resides in Microsoft's OpenAPI YAML reader. A small YAML document that contains nested anchors and aliases can cause the conversion routine to create an exponential number of JSON nodes, leading to excessive memory consumption and process termination. Based on the description, it is inferred that no authentication is required, and a crafted OpenAPI file is enough to trigger the denial of service.

Affected Systems

Affected products are Microsoft.OpenApi.Readers and Microsoft.OpenApi.YamlReader. Versions of Microsoft.OpenApi.YamlReader from 2.0.0-preview.11 through 2.12.2 and from 3.0.0 through 3.10.2, as well as Microsoft.OpenApi.Readers before 1.6.31, are vulnerable. The vulnerability is fixed in YamlReader 2.12.2, 3.10.2, and OpenApi.Readers 1.6.31 and later.

Risk and Exploitability

The CVSS score is 7.5, indicating a high impact denial of service. EPSS is not available, and the issue is not listed in the KEV catalog. Based on the description, it is inferred that exploitation requires only a malicious OpenAPI document; any component that parses user‑supplied OpenAPI files is at risk. The lack of a bound on conversion work creates a potential for catastrophic memory exhaustion across environments that load OpenAPI files during runtime, build, or deployment.

Generated by OpenCVE AI on September 8, 2026 at 19:23 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Microsoft.OpenApi.YamlReader to version 2.12.2 or later, or to 3.10.2 or later, and upgrade Microsoft.OpenApi.Readers to 1.6.31 or later.
  • If an immediate upgrade is not feasible, validate or sanitize incoming OpenAPI files to limit the use of nested anchors and aliases before they reach the parser.
  • Deploy application‑level resource limits such as memory caps or container quotas to mitigate the impact of potential denial‑of‑service attempts.

Generated by OpenCVE AI on September 8, 2026 at 19:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 08 Sep 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 08 Sep 2026 18:00:00 +0000

Type Values Removed Values Added
Description In Microsoft.OpenApi.YamlReader from 2.0.0-preview.11 until 2.12.2 and from 3.0.0 until 3.10.2, and in Microsoft.OpenApi.Readers prior to 1.6.31, a small YAML OpenAPI document containing nested anchors and aliases can cause uncontrolled resource consumption when parsed through the public YAML reader APIs. YAML is parsed through SharpYaml, which represents aliases as shared nodes in a directed acyclic graph, so the parsed YAML graph stays small, but converting that graph to System.Text.Json.Nodes.JsonNode requires every alias to be materialized as an independent node because a JsonNode cannot be attached to multiple parents. Without a bound on that conversion work, a document with N nested anchors each referenced k times can require k^N materialized JSON nodes, leading to excessive memory allocation and process termination through out-of-memory conditions, a billion laughs style denial of service. The patched versions bound the YAML-to-JSON conversion by node count and nesting depth and report an OpenApiDiagnostic error instead of expanding without limit. This vulnerability is fixed in Microsoft.OpenApi.YamlReader 2.12.2 and 3.10.2, and Microsoft.OpenApi.Readers 1.6.31. In Microsoft.OpenApi.YamlReader from 2.0.0-preview.11 until 2.12.0 and from 3.0.0 until 3.10.0, and in Microsoft.OpenApi.Readers prior to 1.6.30, a small YAML OpenAPI document containing nested anchors and aliases can cause uncontrolled resource consumption when parsed through the public YAML reader APIs. YAML is parsed through SharpYaml, which represents aliases as shared nodes in a directed acyclic graph, so the parsed YAML graph stays small, but converting that graph to System.Text.Json.Nodes.JsonNode requires every alias to be materialized as an independent node because a JsonNode cannot be attached to multiple parents. Without a bound on that conversion work, a document with N nested anchors each referenced k times can require k^N materialized JSON nodes, leading to excessive memory allocation and process termination through out-of-memory conditions, a billion laughs style denial of service. The patched versions bound the YAML-to-JSON conversion by node count and nesting depth and report an OpenApiDiagnostic error instead of expanding without limit. This vulnerability is fixed in Microsoft.OpenApi.YamlReader 2.12.0 and 3.10.0, and Microsoft.OpenApi.Readers 1.6.30.

Tue, 08 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Description In Microsoft.OpenApi.YamlReader from 2.0.0-preview.11 until 2.12.2 and from 3.0.0 until 3.10.2, and in Microsoft.OpenApi.Readers prior to 1.6.31, a small YAML OpenAPI document containing nested anchors and aliases can cause uncontrolled resource consumption when parsed through the public YAML reader APIs. YAML is parsed through SharpYaml, which represents aliases as shared nodes in a directed acyclic graph, so the parsed YAML graph stays small, but converting that graph to System.Text.Json.Nodes.JsonNode requires every alias to be materialized as an independent node because a JsonNode cannot be attached to multiple parents. Without a bound on that conversion work, a document with N nested anchors each referenced k times can require k^N materialized JSON nodes, leading to excessive memory allocation and process termination through out-of-memory conditions, a billion laughs style denial of service. The patched versions bound the YAML-to-JSON conversion by node count and nesting depth and report an OpenApiDiagnostic error instead of expanding without limit. This vulnerability is fixed in Microsoft.OpenApi.YamlReader 2.12.2 and 3.10.2, and Microsoft.OpenApi.Readers 1.6.31.
Title Microsoft.OpenApi.YamlReader/Readers vulnerable to denial of service via YAML alias expansion
Weaknesses CWE-400
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-08T17:53:05.565Z

Reserved: 2026-08-10T17:57:26.144Z

Link: CVE-2026-72923

cve-icon Vulnrichment

Updated: 2026-09-08T17:37:08.978Z

cve-icon NVD

Status : Received

Published: 2026-09-08T18:20:16.310

Modified: 2026-09-08T18:20:16.310

Link: CVE-2026-72923

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-08T19:30:07Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption