CVE-2026-49451 Overview
CVE-2026-49451 is a denial-of-service vulnerability in the Microsoft OpenAPI.NET SDK. A small OpenAPI document containing a circular schema reference triggers unbounded recursion during parsing, causing a stack overflow and process termination. The flaw affects both JSON and YAML reader paths exposed by the public OpenAPI.NET reader APIs. Affected versions range from 2.0.0-preview11 up to (but not including) 2.7.5 and 3.5.4. Microsoft has fixed the issue in 2.7.5 and 3.5.4. The weakness is classified under [CWE-674] Uncontrolled Recursion.
Critical Impact
An unauthenticated attacker can crash any .NET service that parses attacker-supplied OpenAPI documents by submitting a malformed specification containing a circular $ref chain.
Affected Products
- Microsoft OpenAPI.NET (Microsoft.OpenApi) versions 2.0.0-preview11 through 2.7.4
- Microsoft OpenAPI.NET (Microsoft.OpenApi) 3.x versions prior to 3.5.4
- .NET applications and services that expose OpenAPI parsing via public reader APIs (JSON and YAML)
Discovery Timeline
- 2026-06-30 - CVE-2026-49451 published to NVD
- 2026-07-02 - Last updated in NVD database
Technical Details for CVE-2026-49451
Vulnerability Analysis
The vulnerability resides in the OpenAPI document parser inside Microsoft.OpenApi. When the parser resolves schema references ($ref), it recursively walks referenced schema nodes. The parser fails to detect a cycle when one schema references itself directly or indirectly. Each recursion frame consumes native stack space until the thread exhausts its stack and the .NET runtime terminates the process with a StackOverflowException.
A StackOverflowException in .NET cannot be caught by user code. The entire host process aborts, taking down all in-flight requests and any co-hosted services. The condition is reachable from any code path that invokes the public reader APIs on untrusted input.
Root Cause
The root cause is uncontrolled recursion during reference resolution. The schema traversal logic lacks a visited-node set or recursion depth limit. A document as small as two schemas that reference each other is sufficient to trigger the failure. Both the JSON reader path and the YAML reader path share the vulnerable resolution logic.
Attack Vector
An attacker submits a crafted OpenAPI document to any endpoint that parses it with a vulnerable version of Microsoft.OpenApi. Typical targets include API gateways, developer portals, import functions in API management tools, and CI/CD pipelines that validate OpenAPI specs. No authentication or user interaction is required. The result is repeatable process termination and denial of service.
A proof-of-concept document consists of two schemas, A and B, where A.$ref points to B and B.$ref points to A. Feeding this document to OpenApiJsonReader.Read or the equivalent YAML reader causes the parsing thread's stack to grow without bound. Refer to the GitHub Security Advisory GHSA-v5pm-xwqc-g5wc for maintainer confirmation of the affected code paths.
Detection Methods for CVE-2026-49451
Indicators of Compromise
- Unexpected StackOverflowException entries in Windows Event Log or stderr for hosts running .NET services that ingest OpenAPI documents
- Application process restarts correlated with inbound HTTP requests containing OpenAPI JSON or YAML payloads
- Uploaded specification files containing mutually recursive $ref chains with no terminating type
Detection Strategies
- Inventory .NET applications and identify those referencing Microsoft.OpenApi at versions below 2.7.5 or 3.5.4 using SBOM tooling or dotnet list package --vulnerable
- Inspect application logs for abnormal process termination events tied to OpenAPI parsing endpoints
- Apply static analysis to detect calls to OpenApiJsonReader and OpenApiYamlReader that accept untrusted input without size or depth guards
Monitoring Recommendations
- Alert on repeated crashes of the same worker process within short intervals on services that expose spec import features
- Monitor request bodies to OpenAPI ingest endpoints for documents containing self-referential $ref patterns
- Track CPU and thread-stack telemetry from .NET runtime performance counters for anomalies during document parsing
How to Mitigate CVE-2026-49451
Immediate Actions Required
- Upgrade Microsoft.OpenApi to version 2.7.5 (for 2.x consumers) or 3.5.4 (for 3.x consumers) immediately
- Restrict OpenAPI ingest endpoints to authenticated users while patching is in progress
- Enforce a maximum document size on any endpoint that accepts OpenAPI JSON or YAML input
Patch Information
Microsoft released fixed builds 2.7.5 and 3.5.4 of the Microsoft.OpenApi NuGet package. Update the package reference and redeploy affected services. Full advisory details are available at the GitHub Security Advisory GHSA-v5pm-xwqc-g5wc.
Workarounds
- Pre-validate submitted documents with a schema-aware linter that rejects circular $ref chains before invoking the reader
- Isolate OpenAPI parsing in a short-lived, sandboxed worker process so a crash does not affect the primary service
- Reject documents that exceed a strict size threshold or a maximum reference depth before parsing begins
# Configuration example: update Microsoft.OpenApi to a fixed version
dotnet add package Microsoft.OpenApi --version 3.5.4
# For projects on the 2.x line:
dotnet add package Microsoft.OpenApi --version 2.7.5
# Verify no vulnerable versions remain in the solution
dotnet list package --vulnerable --include-transitive
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
