Executive brief
Microsoft's OpenAPI.NET libraries (OpenApi.YamlReader and OpenApi.Readers) parse YAML-formatted API specification documents. A specially crafted YAML document containing nested anchor-and-alias structures can cause the parser to consume excessive memory and crash the application, denying service to legitimate users. This affects any application or tool that parses untrusted OpenAPI documents in-process.
Technical details
This is an uncontrolled resource consumption vulnerability (billion laughs / exponential expansion attack) in YAML-to-JSON conversion. The root cause is in how Microsoft.OpenApi.YamlReader and Microsoft.OpenApi.Readers convert YAML aliases to JSON nodes: SharpYaml represents aliases as shared nodes in a directed acyclic graph (staying small), but converting to System.Text.Json.Nodes.JsonNode requires materializing each alias as an independent node. A document with N nested anchors each referenced k times requires k^N materialized nodes. An unauthenticated attacker can submit a malicious OpenAPI document over the network to an application parsing untrusted documents, causing out-of-memory termination. Patches are available: Microsoft.OpenApi.YamlReader 2.12.0 and 3.10.0, and Microsoft.OpenApi.Readers 1.6.30 bound the conversion by node count (5,000,000) and nesting depth (64).
Affected products
- Microsoft OpenApi.YamlReader 2.0.0-preview.11 to <2.12.0, 3.0.0 to <3.10.0
- Microsoft OpenApi.Readers <1.6.30
Timeline
- 2026-08-13: disclosed: Advisory published on GitHub
- 2026-08-13: patched: Microsoft.OpenApi.YamlReader 2.12.0 and 3.10.0, Microsoft.OpenApi.Readers 1.6.30 released