CVE-2026-72923

Name of the Vulnerable Software and Affected Versions Microsoft.OpenApi.YamlReader versions 2.0.0-preview.11 through 2.11.x Microsoft.OpenApi.YamlReader versions 3.0.0 through 3.9.x Microsoft.OpenApi.Readers versions prior to 1.6.30

Description Uncontrolled resource consumption occurs when parsing a small YAML OpenAPI document containing nested anchors and aliases through public YAML reader APIs. While the initial parsing via SharpYaml uses a directed acyclic graph to keep the structure small, the conversion to System.Text.Json.Nodes.JsonNode requires every alias to be materialized as an independent node. Because there is no bound on this conversion, a document with N nested anchors referenced k times can result in k^N materialized JSON nodes. This leads to excessive memory allocation and process termination due to out-of-memory conditions, creating a billion laughs style denial of service (a type of attack where a small input expands exponentially to consume all available system memory).

Recommendations Update Microsoft.OpenApi.YamlReader to version 2.12.0. Update Microsoft.OpenApi.YamlReader to version 3.10.0. Update Microsoft.OpenApi.Readers to version 1.6.30.