CVE-2026-72923

Deferred Deferred - Pending Action

YAML Parsing DoS in Microsoft OpenAPI Libraries

Publication date: 2026-09-08

Last updated on: 2026-10-14

Assigner: GitHub, Inc.

Description

The OpenAPI.NET SDK contains a useful object model for OpenAPI documents in .NET along with common serializers to extract raw OpenAPI JSON and YAML documents from the model. In Microsoft.OpenApi.Readers versions before 1.6.30 and Microsoft.OpenApi.YamlReader from 2.0.0-preview.11 through 2.11.0 and 3.0.0 through 3.9.0, parsing a YAML OpenAPI document with nested anchors and aliases can consume uncontrolled memory. SharpYaml represents aliases as shared nodes in a small directed acyclic graph, but conversion to independent OpenAPI or System.Text.Json.Nodes.JsonNode trees duplicates every aliased path; without a node-count or nesting-depth limit, N nested anchors referenced k times can require k^N materialized nodes and terminate the process through an out-of-memory condition. The fixed readers bound materialization to 5,000,000 nodes and a nesting depth of 64 by default and report an OpenApiDiagnostic error when a limit is exceeded. This vulnerability is fixed in Microsoft.OpenApi.Readers 1.6.30 and Microsoft.OpenApi.YamlReader 2.12.0 and 3.10.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-09-09

EPSS Evaluated

2026-10-18

NVD

CVE-2026-72923

EUVD

EUVD-2026-73080

Affected Vendors & Products

Vendor	Product	Version / Range
microsoft	openapi_yamlreader	From 2.0.0-preview.11 (inc) to 2.12.0 (inc)
microsoft	openapi_yamlreader	From 3.0.0 (inc) to 3.10.0 (inc)
microsoft	openapi_readers	to 1.6.30 (exc)
microsoft	openapi_yamlreader	2.12.0
microsoft	openapi_yamlreader	3.10.0
microsoft	openapi_readers	1.6.30

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability involves uncontrolled resource consumption in Microsoft's OpenAPI YAML reader libraries. When parsing a specially crafted YAML OpenAPI document with nested anchors and aliases, the system may create an excessive number of JSON nodes during conversion, leading to memory exhaustion and process termination. This is similar to a billion laughs denial of service attack.

Detection Guidance

This vulnerability is specific to applications using Microsoft.OpenApi.YamlReader or Microsoft.OpenApi.Readers libraries. To detect it, check if your system or application uses these libraries in versions between 2.0.0-preview.11 and 2.12.0, or 3.0.0 and 3.10.0 for YamlReader, or prior to 1.6.30 for Readers.

Impact Analysis

An attacker could exploit this to crash applications or services that use vulnerable versions of Microsoft.OpenApi.YamlReader or Microsoft.OpenApi.Readers by sending a maliciously crafted YAML document. This could cause denial of service, disrupting availability of affected systems.

Mitigation Strategies

Upgrade to patched versions: Microsoft.OpenApi.YamlReader to 2.12.0 or 3.10.0, and Microsoft.OpenApi.Readers to 1.6.30 or later. Remove or replace any affected libraries if upgrading is not possible.

Hi! I’m here to help you understand CVE-2026-72923. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70