Uncontrolled Resource Consumption in Microsoft.OpenApi Libraries

Microsoft.OpenApi.YamlReader and Microsoft.OpenApi.Readers are affected by an uncontrolled resource consumption vulnerability (CVE-2026-72923) that allows for a "billion laughs" style denial-of-service attack. The vulnerability exists within the conversion layer where YAML anchors and aliases are materialized as JsonNode instances. Because the conversion process lacks boundaries on recursion or node expansion, a small, maliciously crafted YAML document utilizing deeply nested anchors can trigger exponential memory allocation. This lead to Out-of-Memory (OOM) conditions and terminates the host application process. This vulnerability is highly relevant for any developer tools, CLIs, or services that parse OpenAPI documents provided by untrusted third parties.

Impact

Successful exploitation results in the denial of service of any application utilizing these libraries to process untrusted OpenAPI YAML files. The impact is limited to service unavailability caused by process termination due to memory exhaustion. No evidence suggests remote code execution, authentication bypass, or data exfiltration.

Recommendation

1. Upgrade Microsoft.OpenApi.YamlReader to version 2.12.0 or 3.10.0 immediately.
2. Upgrade Microsoft.OpenApi.Readers to version 1.6.30 or higher.
3. If immediate patching is not possible, evaluate the use of process-wide static properties YamlConverter.MaxNodeCount and YamlConverter.MaxDepth to enforce safer parsing limits.
4. Implement architecture-level isolation for parsing operations by offloading the parsing of untrusted OpenAPI documents to sandboxed or sidecar processes to limit the impact of potential crashes.