{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3amicrosoftopenapi.yamlreader/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:microsoft:openapi.yamlreader:*:*:*:*:*:*:*:*","cpe:2.3:a:microsoft:openapi.readers:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-72923"}],"_cs_exploited":true,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Microsoft.OpenApi.YamlReader (2.0.0-preview.11 to \u003c 2.12.0, 3.0.0 to \u003c 3.10.0)","Microsoft.OpenApi.Readers (\u003c 1.6.30)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"threat","_cs_vendors":["Microsoft"],"content_html":"\u003cp\u003eMicrosoft.OpenApi.YamlReader and Microsoft.OpenApi.Readers are affected by an uncontrolled resource consumption vulnerability (CVE-2026-72923) that allows for a \u0026quot;billion laughs\u0026quot; style denial-of-service attack. The vulnerability exists within the conversion layer where YAML anchors and aliases are materialized as \u003ccode\u003eJsonNode\u003c/code\u003e instances. Because the conversion process lacks boundaries on recursion or node expansion, a small, maliciously crafted YAML document utilizing deeply nested anchors can trigger exponential memory allocation. This lead to Out-of-Memory (OOM) conditions and terminates the host application process. This vulnerability is highly relevant for any developer tools, CLIs, or services that parse OpenAPI documents provided by untrusted third parties.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in the denial of service of any application utilizing these libraries to process untrusted OpenAPI YAML files. The impact is limited to service unavailability caused by process termination due to memory exhaustion. No evidence suggests remote code execution, authentication bypass, or data exfiltration.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade Microsoft.OpenApi.YamlReader to version 2.12.0 or 3.10.0 immediately.\u003c/li\u003e\n\u003cli\u003eUpgrade Microsoft.OpenApi.Readers to version 1.6.30 or higher.\u003c/li\u003e\n\u003cli\u003eIf immediate patching is not possible, evaluate the use of process-wide static properties \u003ccode\u003eYamlConverter.MaxNodeCount\u003c/code\u003e and \u003ccode\u003eYamlConverter.MaxDepth\u003c/code\u003e to enforce safer parsing limits.\u003c/li\u003e\n\u003cli\u003eImplement architecture-level isolation for parsing operations by offloading the parsing of untrusted OpenAPI documents to sandboxed or sidecar processes to limit the impact of potential crashes.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-14T22:21:55Z","date_published":"2026-10-14T22:21:55Z","id":"https://feed.craftedsignal.io/briefs/2026-10-microsoft-openapi-dos/","summary":"The Microsoft.OpenApi.YamlReader and Microsoft.OpenApi.Readers libraries are susceptible to a billion laughs denial-of-service attack, where crafted YAML files with nested anchors cause memory exhaustion and process termination during conversion.","title":"Uncontrolled Resource Consumption in Microsoft.OpenApi Libraries","url":"https://feed.craftedsignal.io/briefs/2026-10-microsoft-openapi-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:microsoft:openapi.yamlreader:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}