Microsoft OpenAPI.NET vulnerabilities

Latest Microsoft OpenAPI.NET CVEs

Newest publication first

1. CVE-2026-72923 Microsoft.OpenApi.YamlReader vulnerable to denial of service via YAML alias expansion

   Published 2026-09-08

   High·CVSS 7.5

   The OpenAPI.NET SDK contains a useful object model for OpenAPI documents in .NET along with common serializers to extract raw OpenAPI JSON and YAML documents from the model. In Microsoft.OpenApi.Readers versions before 1.6.30 and Microsoft.OpenApi.YamlReader from 2.0.0-preview.11...

2. CVE-2026-49451 Microsoft.OpenAPI: Circular schema references may terminate OpenAPI parsing

   Published 2026-06-30

   High·CVSS 7.5

   The OpenAPI.NET SDK contains a useful object model for OpenAPI documents in .NET along with common serializers to extract raw OpenAPI JSON and YAML documents from the model. From 2.0.0-preview11 until 2.7.5 and 3.5.4, a small OpenAPI document containing a circular schema referenc...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.