CVE-2026-72923 Details
Description
In Microsoft.OpenApi.YamlReader from 2.0.0-preview.11 until 2.12.0 and from 3.0.0 until 3.10.0, and in Microsoft.OpenApi.Readers prior to 1.6.30, a small YAML OpenAPI document containing nested anchors and aliases can cause uncontrolled resource consumption when parsed through the public YAML reader APIs. YAML is parsed through SharpYaml, which represents aliases as shared nodes in a directed acyclic graph, so the parsed YAML graph stays small, but converting that graph to System.Text.Json.Nodes.JsonNode requires every alias to be materialized as an independent node because a JsonNode cannot be attached to multiple parents. Without a bound on that conversion work, a document with N nested anchors each referenced k times can require k^N materialized JSON nodes, leading to excessive memory allocation and process termination through out-of-memory conditions, a billion laughs style denial of service. The patched versions bound the YAML-to-JSON conversion by node count and nesting depth and report an OpenApiDiagnostic error instead of expanding without limit. This vulnerability is fixed in Microsoft.OpenApi.YamlReader 2.12.0 and 3.10.0, and Microsoft.OpenApi.Readers 1.6.30.
A denial-of-service vulnerability has been identified in Microsoft.OpenApi.YamlReader and Microsoft.OpenApi.Readers. The issue arises when these libraries parse YAML OpenAPI documents containing nested anchors and aliases, leading to excessive memory consumption and process termination. This vulnerability affects Microsoft.OpenApi.YamlReader versions 2.0.0-preview.11 prior to 2.12.0, and 3.0.0 prior to 3.10.0, as well as Microsoft.OpenApi.Readers versions prior to 1.6.30. The problem stems from the YAML parser, SharpYaml, which represents aliases as shared nodes in a directed acyclic graph. While this keeps the initial YAML graph small, converting it to System.Text.Json.Nodes.JsonNode requires each alias to be materialized as an independent node, causing a 'billion laughs' style denial-of-service when the document is crafted with nested anchors and aliases.
Users should upgrade to Microsoft.OpenApi.YamlReader versions 2.12.0 or 3.10.0, or Microsoft.OpenApi.Readers version 1.6.30, depending on the major version line in use. The patched versions limit the YAML-to-JSON conversion process by node count and nesting depth, preventing unbounded expansion. After applying the update, the default limits can be adjusted if necessary for trusted workloads.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 8, 2026CISA-ADP
Assessed Sep 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/microsoft/OpenAPI.NET/security/advisories/GHSA-7pxr-59rr-hqj2 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Microsoft.OpenApi.YamlReader | >= 2.0.0-preview.11, < 2.12.0 (semver) >= 3.0.0, < 3.10.0 (semver) |
CPE
Remediation
| |
| Microsoft.OpenApi.Readers | < 1.6.30 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 8, 2026 | New CVE Received | [email protected] |
| Sep 8, 2026 | CVE Modified | CISA-ADP |