CVE-2026-49451 Details
Description
The OpenAPI.NET SDK contains a useful object model for OpenAPI documents in .NET along with common serializers to extract raw OpenAPI JSON and YAML documents from the model. From 2.0.0-preview11 until 2.7.5 and 3.5.4, a small OpenAPI document containing a circular schema reference can cause process termination through stack overflow in Microsoft.OpenApi. The issue affects OpenAPI document parsing through public OpenAPI.NET reader APIs and has been confirmed across both JSON and YAML reader paths. This vulnerability is fixed in 2.7.5 and 3.5.4.
A stack overflow vulnerability causing process termination has been identified in the OpenAPI.NET SDK, specifically in versions 2.0.0-preview11 prior to 2.7.5 and 3.0.0 prior to 3.5.4. This issue arises when an OpenAPI document with a circular schema reference is processed, leading to a stack overflow. The vulnerability affects OpenAPI document parsing through the public OpenAPI.NET reader APIs, and has been confirmed in both JSON and YAML formats.
Users should upgrade to OpenAPI.NET SDK versions 2.7.5 or 3.5.4, depending on the major version line they are using. Additionally, OpenAPI documents from untrusted sources should be parsed in an isolated process to mitigate the risk of process termination.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-674 | Uncontrolled Recursion | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 30, 2026 | CVE Modified | CISA-ADP |
| Jun 30, 2026 | New CVE Received | [email protected] |