CVE-2026-72923

CVE-2026-72923 is a high-severity uncontrolled resource consumption vulnerability in Microsoft.OpenApi.YamlReader (nuget), affecting versions >= 3.0.0, < 3.10.0. It is fixed in 3.10.0, 2.12.0, 1.6.30.

Does this CVE actually affect you?

Kodem shows which CVEs are reachable and running in your applications, so you fix what's exploitable, not just what's listed.

Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

Runtime intelligence, not another scanner.

Summary

Microsoft.OpenApi.YamlReader vulnerable to denial of service via YAML alias expansion

Affected versions

Microsoft.OpenApi.YamlReader

  • >= 2.0.0-preview.11, < 2.12.0
  • >= 3.0.0, < 3.10.0

Microsoft.OpenApi.Readers

  • < 1.6.30

Impact

Applications, CLIs, developer tools, or services that parse untrusted YAML OpenAPI documents in-process may be terminated by a crafted YAML document containing nested anchors and aliases.

The impact is availability/process termination only. This report does not claim remote code execution, authentication bypass, credential exposure, privilege escalation, data exposure, or Microsoft hosted service impact.

Details

Microsoft.OpenApi.YamlReader and Microsoft.OpenApi.Readers parses YAML through SharpYaml. SharpYaml represents aliases as shared YamlNode instances in a directed acyclic graph, so the initial parsed YAML graph remains small. During conversion to System.Text.Json.Nodes.JsonNode, aliases must be materialized as independent nodes because JsonNode instances cannot be attached to multiple parents.

Without a bound on that conversion work, a small YAML document using nested anchors and aliases can expand exponentially during conversion. With N nested anchors each referenced k times, conversion can require k^N materialized JSON nodes, leading to excessive memory allocation and possible process termination.

This is an uncontrolled resource consumption vulnerability, also known as a "billion laughs" style denial of service.

Example payload

openapi: 3.0.0
info:
  title: Test
  version: 0.0.1
paths: {}
x-a: &a ["lol", "lol", "lol", "lol", "lol", "lol", "lol", "lol", "lol"]
x-b: &b [*a, *a, *a, *a, *a, *a, *a, *a, *a]
x-c: &c [*b, *b, *b, *b, *b, *b, *b, *b, *b]
x-d: &d [*c, *c, *c, *c, *c, *c, *c, *c, *c]
x-e: &e [*d, *d, *d, *d, *d, *d, *d, *d, *d]
x-f: &f [*e, *e, *e, *e, *e, *e, *e, *e, *e]

Remediation

Users should upgrade to Microsoft.OpenApi.YamlReader 2.12.0 or 3.10.0, or Microsoft.OpenApi.Readers 1.6.30, depending on the major version line they consume.

The patched versions bound YAML-to-JSON conversion work and fail fast instead of allowing unbounded expansion. The default limits are:

  • Maximum materialized node count: 5,000,000
  • Maximum nesting depth: 64

When the limits are exceeded, OpenApiYamlReader.Read reports an OpenApiDiagnostic error and does not return a parsed document.

The limits are exposed as process-wide static properties on YamlConverter for consumers that need to tune them for trusted workloads:

  • YamlConverter.MaxNodeCount
  • YamlConverter.MaxDepth

Applications that parse OpenAPI documents from untrusted sources should avoid parsing those documents in the primary application process when possible. Running parsing in an isolated process can reduce the blast radius of parser failures.

Impact

A small YAML OpenAPI document containing nested anchors and aliases can cause uncontrolled resource consumption in Microsoft.OpenApi.YamlReader and Microsoft.OpenApi.Readers. The issue affects OpenAPI document parsing through the public YAML reader APIs and can cause the parsing process to allocate excessive memory and terminate through out-of-memory conditions.

Crafted input forces the application to consume excessive CPU, memory, or other resources, degrading or denying service. Typical impact: denial of service.

CVE-2026-72923 has a CVSS score of 7.5 (High). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (3.10.0, 2.12.0, 1.6.30); upgrading removes the vulnerable code path.

Affected versions

Microsoft.OpenApi.YamlReader (>= 3.0.0, < 3.10.0) Microsoft.OpenApi.YamlReader (>= 2.0.0-preview.11, < 2.12.0) Microsoft.OpenApi.Readers (< 1.6.30)

Security releases

Microsoft.OpenApi.YamlReader → 3.10.0 (nuget) Microsoft.OpenApi.YamlReader → 2.12.0 (nuget) Microsoft.OpenApi.Readers → 1.6.30 (nuget)

Kodem intelligence

Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.

Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.

Already deployed Kodem?

See it in your environmentNew to Kodem? Get a demo →

Remediation advice

  • For the 1.X major version, versions 1.6.30 and above are patched.
  • For the 2.X major version, versions 2.12.0 and above are patched.
  • For the 3.X major version, versions 3.10.0 and above are patched.

Frequently Asked Questions

  1. What is CVE-2026-72923? CVE-2026-72923 is a high-severity uncontrolled resource consumption vulnerability in Microsoft.OpenApi.YamlReader (nuget), affecting versions >= 3.0.0, < 3.10.0. It is fixed in 3.10.0, 2.12.0, 1.6.30. Crafted input forces the application to consume excessive CPU, memory, or other resources, degrading or denying service.
  2. How severe is CVE-2026-72923? CVE-2026-72923 has a CVSS score of 7.5 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
  3. Which packages are affected by CVE-2026-72923?
    • Microsoft.OpenApi.YamlReader (nuget) (versions >= 3.0.0, < 3.10.0)
    • Microsoft.OpenApi.Readers (nuget) (versions < 1.6.30)
  4. Is there a fix for CVE-2026-72923? Yes. CVE-2026-72923 is fixed in 3.10.0, 2.12.0, 1.6.30. Upgrade to this version or later.
  5. Is CVE-2026-72923 exploitable, and should I be worried? Whether CVE-2026-72923 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
  6. What actually determines whether CVE-2026-72923 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
  7. How do I fix CVE-2026-72923?
    • Upgrade Microsoft.OpenApi.YamlReader to 3.10.0 or later
    • Upgrade Microsoft.OpenApi.YamlReader to 2.12.0 or later
    • Upgrade Microsoft.OpenApi.Readers to 1.6.30 or later

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo