Executive brief
Microsoft OpenAPI.NET is a library used by developers to process and read OpenAPI documents, which describe how web services work. A security flaw allows a specially crafted, small document to crash any application or service that attempts to read it. This results in a denial-of-service, potentially taking down developer tools, command-line interfaces, or web services that process untrusted API definitions.
Technical details
The vulnerability is classified as uncontrolled recursion (CWE-674) within the Microsoft.OpenApi library. When parsing an OpenAPI document (JSON or YAML) that contains circular schema references (e.g., Schema A referencing Schema B, which references Schema A), the reader APIs fail to properly handle the recursion, leading to a stack overflow and immediate process termination. The issue affects the public reader APIs in both the 2.x and 3.x release lines. Attackers can exploit this by submitting a malicious payload to any service that parses untrusted OpenAPI definitions in-process. The vulnerability is resolved in versions 2.7.5 and 3.5.4.
Affected products
- Microsoft OpenAPI.NET (Microsoft.OpenApi) >= 2.0.0-preview11, < 2.7.5; >= 3.0.0, < 3.5.4
Timeline
- 2026-05-26: advisory: GitHub advisory published by maintainers
- 2026-06-30: disclosed: CVE published to NVD