CVE-2026-72923: Microsoft OpenApi YAML Parser DOS Vulnerability

CVE-2026-72923 Overview

CVE-2026-72923 is a resource exhaustion vulnerability [CWE-400] in the Microsoft OpenAPI.NET YAML reader libraries. Attackers can submit a small YAML OpenAPI document that contains nested anchors and aliases to trigger uncontrolled memory allocation during parsing. The flaw affects Microsoft.OpenApi.YamlReader from 2.0.0-preview.11 up to 2.12.0, from 3.0.0 up to 3.10.0, and Microsoft.OpenApi.Readers prior to 1.6.30. Successful exploitation forces an out-of-memory condition that terminates the host process, producing a billion-laughs style denial of service against any application that parses untrusted OpenAPI documents.

Critical Impact
A network-reachable attacker can crash any .NET service that accepts YAML OpenAPI input by submitting a compact document with nested anchors and aliases.

Affected Products

Microsoft.OpenApi.YamlReader from 2.0.0-preview.11 until 2.12.0
Microsoft.OpenApi.YamlReader from 3.0.0 until 3.10.0
Microsoft.OpenApi.Readers prior to 1.6.30

Discovery Timeline

2026-09-08 - CVE-2026-72923 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-72923

Vulnerability Analysis

The vulnerability lives in the YAML-to-JSON conversion path exposed by the public YAML reader APIs. The libraries parse YAML through SharpYaml, which represents aliases as shared nodes inside a directed acyclic graph. That parsed graph stays small on disk and in memory. The problem appears when the reader converts the graph into System.Text.Json.Nodes.JsonNode objects. A JsonNode cannot be attached to multiple parents, so every alias reference must be materialized as an independent node. A document with N nested anchors, each referenced k times, expands to roughly k^N materialized JSON nodes. The unbounded conversion consumes memory until the process terminates, matching the classic billion-laughs denial of service pattern.

Root Cause

The root cause is a missing bound on conversion work when translating shared YAML alias nodes into tree-structured JsonNode objects. The parser preserves graph sharing, but the converter unfolds every alias without tracking cumulative node count or nesting depth, allowing exponential expansion.

Attack Vector

An unauthenticated attacker submits a crafted YAML OpenAPI document to any endpoint or tool that invokes the affected reader APIs. The attack requires no privileges and no user interaction. Common targets include API gateways, developer tooling, CI pipelines, and services that ingest third-party OpenAPI definitions. See the GitHub Security Advisory for the reference proof-of-concept structure using nested anchors and repeated aliases.

Detection Methods for CVE-2026-72923

Indicators of Compromise

Sudden OutOfMemoryException faults or process terminations in services that parse OpenAPI or YAML input.
Sharp spikes in managed heap size and garbage collection pressure immediately after receiving a YAML payload.
Inbound YAML documents that contain deeply nested &anchor definitions with repeated *alias references.

Detection Strategies

Inspect application logs for Microsoft.OpenApi stack frames preceding memory faults or unhandled exceptions.
Add pre-parse validation that rejects YAML payloads exceeding a fixed byte size, anchor count, or nesting depth.
Instrument the reader call sites to capture OpenApiDiagnostic errors emitted by patched versions when bounds are exceeded.

Monitoring Recommendations

Alert on repeated crash-loop restarts of API services that accept YAML input from external clients.
Monitor process working set and Gen2 GC activity for services exposing OpenAPI ingestion endpoints.
Track WAF or gateway telemetry for YAML payloads with anomalous anchor-to-size ratios.

How to Mitigate CVE-2026-72923

Immediate Actions Required

Upgrade Microsoft.OpenApi.YamlReader to 2.12.0 or 3.10.0, depending on the major version in use.
Upgrade Microsoft.OpenApi.Readers to 1.6.30 or later.
Audit downstream consumers and rebuild any application that transitively references vulnerable versions.

Patch Information

Microsoft fixed the issue by bounding YAML-to-JSON conversion using node count and nesting depth limits. When a document exceeds those limits, the reader reports an OpenApiDiagnostic error instead of expanding without limit. Full details are available in the GitHub Security Advisory GHSA-7pxr-59rr-hqj2.

Workarounds

Reject YAML OpenAPI documents from untrusted sources at the network edge until patches are deployed.
Enforce request size limits and parsing timeouts on endpoints that invoke the YAML reader APIs.
Sandbox parsing in a separate process with a hard memory quota so that out-of-memory conditions do not affect the primary service.

bash

# Update the vulnerable package to the fixed version
dotnet add package Microsoft.OpenApi.YamlReader --version 3.10.0
dotnet add package Microsoft.OpenApi.Readers --version 1.6.30