CVE-2026-72923 with a CVSS score of 7.5 is a denial-of-service vulnerability in the OpenAPI YAML parsing components Microsoft.OpenApi.YamlReader and Microsoft.OpenApi.Readers, where uncontrolled resource consumption occurs while converting YAML anchors and aliases into JSON nodes. The affected versions are Microsoft.OpenApi.YamlReader >= 2.0.0-preview.11, < 2.12.0 and >= 3.0.0, < 3.10.0, and Microsoft.OpenApi.Readers < 1.6.30. An attacker with network access and no privileges can supply a small crafted YAML OpenAPI document containing nested anchors and aliases to any application, CLI, developer tool, or service that parses untrusted YAML through the public reader APIs. During conversion, alias expansion can grow exponentially, causing excessive memory allocation and out-of-memory termination of the parsing process. The business impact is availability loss: affected processes may stop, interrupting API documentation processing, build or deployment automation, developer workflows, or services that rely on in-process OpenAPI parsing. The issue does not provide remote code execution, authentication bypass, credential exposure, privilege escalation, or data exposure.
The following reports contain further technical details:[/subscribe_to_unlock_form]
CVE-2026-72923 with a CVSS score of 7.5 is a denial-of-service vulnerability in the OpenAPI YAML parsing components Microsoft.OpenApi.YamlReader and Microsoft.OpenApi.Readers, where uncontrolled resource consumption occurs while converting YAML anchors and aliases into JSON nodes. The affected versions are Microsoft.OpenApi.YamlReader >= 2.0.0-preview.11, < 2.12.0 and >= 3.0.0, < 3.10.0, and Microsoft.OpenApi.Readers < 1.6.30. An attacker with network access and no privileges can supply a small crafted YAML OpenAPI document containing nested anchors and aliases to any application, CLI, developer tool, or service that parses untrusted YAML through the public reader APIs. During conversion, alias expansion can grow exponentially, causing excessive memory allocation and out-of-memory termination of the parsing process. The business impact is availability loss: affected processes may stop, interrupting API documentation processing, build or deployment automation, developer workflows, or services that rely on in-process OpenAPI parsing. The issue does not provide remote code execution, authentication bypass, credential exposure, privilege escalation, or data exposure.
The following reports contain further technical details:[emaillocker id="1283"]
[/emaillocker]