CVE-2026-72923

CVE-2026-72923 is a denial-of-service flaw (CWE-400, uncontrolled resource consumption) in the Microsoft.OpenApi.YamlReader package (versions 2.0.0-preview.11 until 2.12.0, and 3.0.0 until 3.10.0) and the Microsoft.OpenApi.Readers package (prior to 1.6.30), which .NET applications use to parse YAML OpenAPI documents. A small attacker-supplied YAML document using nested anchors and aliases is enough: SharpYaml stores aliases as shared nodes in a compact directed-acyclic graph, but converting that graph to System.Text.Json.Nodes.JsonNode forces every alias to be materialized as an independent node because a JsonNode cannot be attached to multiple parents, so N nested anchors each referenced k times can balloon into k^N JSON nodes. Because the YAML-to-JSON conversion had no bound, an attacker who can make an application parse a crafted document gains remote denial of service: memory allocation grows without limit until the process terminates on an out-of-memory condition, with no confidentiality or integrity impact (CVSS 3.1 7.5, availability only). Any .NET service or tooling that parses untrusted or attacker-influenced OpenAPI YAML with these libraries is affected; the patched releases bound the conversion by node count and nesting depth and report an OpenApiDiagnostic error instead of expanding without limit. No public proof-of-concept is known, the flaw is not in CISA's KEV catalog, and EPSS currently assigns about a 1.2% probability of exploitation within 30 days, so no exploitation is known to date.

What to do: Upgrade Microsoft.OpenApi.YamlReader to 2.12.0 (2.x line) or 3.10.0 (3.x line), and Microsoft.OpenApi.Readers to 1.6.30, checking NuGet dependency trees for transitive Microsoft.OpenApi.* references. Until patched, avoid parsing untrusted or user-supplied YAML OpenAPI documents with these libraries or restrict such documents to trusted sources and bounded sizes. After upgrading, over-nested or over-aliased documents will be rejected with an OpenApiDiagnostic error rather than expanded without limit.