CVE-2026-72923 microsoft CVE debrief

Who should care

Defenders responsible for .NET applications using OpenAPI.NET, especially those parsing YAML documents from untrusted sources, should assess exposure and prioritize patching or mitigation.

Why it matters

CVE-2026-72923 is a denial-of-service vulnerability in Microsoft OpenAPI.NET SDK's YamlReader component. Defenders should prioritize patching, especially in environments parsing YAML from untrusted sources. The vulnerability can lead to uncontrolled memory consumption, causing potential crashes or performance degradation. Affected versions require verification and mitigation to prevent exploitation.

• Potential denial-of-service attacks via excessive memory consumption
• Need to verify and limit exposure in .NET applications using OpenAPI.NET
• Possible performance degradation or crashes due to uncontrolled memory usage
• Requires patching or mitigation to prevent exploitation

Technical summary

The OpenAPI.NET SDK contains a vulnerability in the YamlReader component, which can lead to denial-of-service attacks via YAML alias expansion. The vulnerability occurs when parsing YAML OpenAPI documents with nested anchors and aliases, causing uncontrolled memory consumption. The issue affects Microsoft.OpenApi.Readers versions before 1.6.30 and Microsoft.OpenApi.YamlReader from 2.0.0-preview.11 through 2.11.0 and 3.0.0 through 3.9.0.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially in environments where OpenAPI.NET is used to parse YAML documents from untrusted sources.

Recommended defensive actions

• Patch Microsoft.OpenApi.Readers to version 1.6.30 or later
• Patch Microsoft.OpenApi.YamlReader to version 2.12.0 or later, or 3.10.0 or later
• Restrict access to YAML OpenAPI documents from untrusted sources
• Monitor for OpenApiDiagnostic errors indicating exceeded materialization limits
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is caused by the way SharpYaml represents aliases as shared nodes in a small directed acyclic graph, which can lead to uncontrolled memory consumption when converting to independent OpenAPI or System.Text.Json.Nodes.JsonNode trees. The fixed readers bound materialization to 5,000,000 nodes and a nesting depth of 64 by default and report an OpenApiDiagnostic error when a limit is exceeded.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.