CVE-2026-72923: CWE-400: Uncontrolled Resource Consumption in microsoft OpenAPI.NET

The vulnerability in Microsoft.OpenApi.YamlReader and Microsoft.OpenApi.Readers is caused by the way YAML aliases and anchors are expanded during conversion from SharpYaml's DAG representation to System.Text.Json.Nodes.JsonNode instances. Because JsonNode instances cannot be shared among multiple parents, nested anchors referenced multiple times can cause exponential growth in memory usage (k^N nodes for N nested anchors each referenced k times). This uncontrolled resource consumption can cause excessive memory allocation and process termination. The issue affects specific version ranges of the Microsoft.OpenApi.YamlReader and Microsoft.OpenApi.Readers libraries. Patched versions 1.6.30+, 2.12.0+, and 3.10.0+ introduce limits on maximum materialized node count (5,000,000) and maximum nesting depth (64), causing the parser to fail fast with an error instead of crashing. Users parsing untrusted YAML OpenAPI documents are advised to upgrade and consider isolating parsing in separate processes to reduce impact.

Applications or services parsing untrusted YAML OpenAPI documents using affected versions of Microsoft.OpenApi.YamlReader or Microsoft.OpenApi.Readers may experience process termination due to excessive memory consumption triggered by crafted YAML documents with nested anchors and aliases. The impact is limited to availability (denial of service) and does not include remote code execution, privilege escalation, data exposure, or impact on Microsoft hosted services.

Users should upgrade to Microsoft.OpenApi.YamlReader version 2.12.0 or later, or 3.10.0 or later, or Microsoft.OpenApi.Readers version 1.6.30 or later, depending on the major version in use. These patched versions enforce limits on YAML-to-JSON conversion to prevent unbounded resource consumption and fail fast with an error when limits are exceeded. Additionally, applications parsing untrusted OpenAPI documents should consider isolating the parsing process to reduce the blast radius of potential parser failures.