CVE-2026-72923High· 7.5▾ TwilightThe OpenAPI.NET SDK contains a useful object model for OpenAPI documents in .NET along with common serializers to extract raw OpenAPI JSON and YAML documents from the model. In Microsoft.OpenApi.Readers versions before 1.6.30 and Microso…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.4 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 10.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
1.2%
Last analysed / modified upstream
1.2% → 1.9%
The OpenAPI.NET SDK contains a useful object model for OpenAPI documents in .NET along with common serializers to extract raw OpenAPI JSON and YAML documents from the model. In Microsoft.OpenApi.Readers versions before 1.6.30 and Microsoft.OpenApi.YamlReader from 2.0.0-preview.11 through 2.11.0 and 3.0.0 through 3.9.0, parsing a YAML OpenAPI document with nested anchors and aliases can consume uncontrolled memory. SharpYaml represents aliases as shared nodes in a small directed acyclic graph, but conversion to independent OpenAPI or System.Text.Json.Nodes.JsonNode trees duplicates every aliased path; without a node-count or nesting-depth limit, N nested anchors referenced k times can require k^N materialized nodes and terminate the process through an out-of-memory condition. The fixed readers bound materialization to 5,000,000 nodes and a nesting depth of 64 by default and report an OpenApiDiagnostic error when a limit is exceeded. This vulnerability is fixed in Microsoft.OpenApi.Readers 1.6.30 and Microsoft.OpenApi.YamlReader 2.12.0 and 3.10.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
Microsoft.OpenApi.YamlReader >= 3.0.0, < 3.10.0Microsoft.OpenApi.YamlReader >= 2.0.0-preview.11, < 2.12.0Microsoft.OpenApi.Readers < 1.6.30Patched in:
Microsoft.OpenApi.YamlReader 3.10.0Microsoft.OpenApi.YamlReader 2.12.0Microsoft.OpenApi.Readers 1.6.30Connected by shared product, vendor, weakness, or advisory.
CVE-2026-109468High· 7.5ASP.NET Core Denial of Service Vulnerability
CVE-2026-97811High· 7.8Double free in OpenSSH for Windows allows an authorized attacker to elevate privileges locally.
CVE-2021-31957Medium· 5.9ASP.NET Core Denial of Service Vulnerability
CVE-2024-12254High· 7.5Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would not "pause" writing and signal to the Protocol to drain the buffer to the wire once the write buffer reached the "high-water mark"
CVE-2021-3759Medium· 5.5A memory overflow vulnerability was found in the Linux kernel’s ipc functionality of the memcg subsystem, in the way a user calls the semget function multiple times, creating semaphores
CVE-2024-0241High· 7.5encoded_id-rails versions before 1.0.0.beta2 are affected by an uncontrolled resource consumption vulnerability