CVE-2026-72923
Microsoft.OpenApi.YamlReader vulnerable to denial of service via YAML alias expansion
Published Sep 8, 2026 · updated Oct 14, 2026 · microsoft OpenAPI.NET
### Impact A small YAML OpenAPI document containing nested anchors and aliases can cause uncontrolled resource consumption in Microsoft.OpenApi.YamlReader and Microsoft.OpenApi.Readers. The issue affects OpenAPI document parsing through the public YAML reader APIs and can cause the parsing process to allocate excessive memory and terminate through out-of-memory conditions. ## Affected versions ### Microsoft.OpenApi.YamlReader * * ### Microsoft.OpenApi.Readers * ### Patches * For the 1.X major version, versions 1.6.30 and above are patched. * For the 2.X major version, versions 2.12.0 and above are patched. * For the 3.X major version, versions 3.10.0 and above are patched. ## Impact Applications, CLIs, developer tools, or services that parse untrusted YAML OpenAPI documents in-process may be terminated by a crafted YAML document containing nested anchors and aliases. The impact is availability/process termination only. This report does not claim remote code execution, authentication bypass, credential exposure, privilege escalation, data exposure, or Microsoft hosted service impact. ## Details Microsoft.OpenApi.YamlReader and Microsoft.OpenApi.Readers parses YAML through SharpYaml. SharpYaml represents aliases as shared instances in a directed acyclic graph, so the initial parsed YAML graph remains small. During conversion to , aliases must be materialized as independent nodes because instances cannot be attached to multiple parents. Without a bound on that conversion work, a small YAML document using nested anchors and aliases can expand exponentially during conversion. With nested anchors each referenced times, conversion can require materialized JSON nodes, leading to excessive memory allocation and possible process termination. This is an uncontrolled resource consumption vulnerability, also known as a "billion laughs" style denial of service. ### Example payload ## Remediation Users should upgrade to Microsoft.OpenApi.YamlReader or , or Microsoft.OpenApi.Reader
Timeline
Detection, updates, and resolution for this record.
Oct 14, 2026 · GitHub Advisory Database
Detected
### Impact A small YAML OpenAPI document containing nested anchors and aliases can cause uncontrolled resource consumption in Microsoft.OpenApi.YamlReader and Microsoft.OpenApi.Readers. The issue affects OpenAPI document parsing through the public YAML reader APIs and can cause the parsing process to allocate excessive memory and terminate through out-of-memory conditions. ## Affected versions ###
Oct 14, 2026 · GitHub Advisory Database
Fix available
Microsoft.OpenApi.YamlReader fixed in 3.10.0; Microsoft.OpenApi.YamlReader fixed in 2.12.0; Microsoft.OpenApi.Readers fixed in 1.6.30
Oct 14, 2026 · GitHub Advisory Database
Fix available
Microsoft.OpenApi.YamlReader fixed in 3.10.0
Oct 14, 2026 · GitHub Advisory Database
Fix available
Microsoft.OpenApi.YamlReader fixed in 2.12.0
Oct 14, 2026 · GitHub Advisory Database
Fix available
Microsoft.OpenApi.Readers fixed in 1.6.30
Oct 14, 2026 · GitHub Advisory Database
Updated
### Impact A small YAML OpenAPI document containing nested anchors and aliases can cause uncontrolled resource consumption in Microsoft.OpenApi.YamlReader and Microsoft.OpenApi.Readers. The issue affects OpenAPI document parsing through the public YAML reader APIs and can cause the parsing process to allocate excessive memory and terminate through out-of-memory conditions. ## Affected versions ###
Oct 14, 2026 · NIST NVD
Updated
The OpenAPI.NET SDK contains a useful object model for OpenAPI documents in .NET along with common serializers to extract raw OpenAPI JSON and YAML documents from the model. In Microsoft.OpenApi.Readers versions before 1.6.30 and Microsoft.OpenApi.YamlReader from 2.0.0-preview.11 through 2.11.0 and 3.0.0 through 3.9.0, parsing a YAML OpenAPI document with nested anchors and aliases can consume unc
Affected
- NuGet Microsoft.OpenApi.Readers0 → 1.6.30
- NuGet Microsoft.OpenApi.YamlReader2.0.0-preview.11 → 2.12.0
- NuGet Microsoft.OpenApi.YamlReader3.0.0 → 3.10.0
- vendor microsoft OpenAPI.NETversion unspecified
Sources
- CVE.orgCVE-2026-72923
The OpenAPI.NET SDK contains a useful object model for OpenAPI documents in .NET along with common serializers to extract raw OpenAPI JSON and YAML documents from the model. In Microsoft.OpenApi.Readers versions before 1.6.30 and Microsoft.OpenApi.YamlReader from 2.0.0-preview.11
cve.org - FIRST EPSSCVE-2026-72923
30-day exploitation probability 1.2%
first.org - GitHub Advisory DatabaseGHSA-7pxr-59rr-hqj2
GitHub Advisory Database record mirrored by OSV.
github.com - NIST NVDCVE-2026-72923
The OpenAPI.NET SDK contains a useful object model for OpenAPI documents in .NET along with common serializers to extract raw OpenAPI JSON and YAML documents from the model. In Microsoft.OpenApi.Readers versions before 1.6.30 and Microsoft.OpenApi.YamlReader from 2.0.0-preview.11
nvd.nist.gov - OSV.devGHSA-7pxr-59rr-hqj2
Microsoft.OpenApi.YamlReader vulnerable to denial of service via YAML alias expansion
osv.dev