Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Microsoft OpenAPI SDK may crash on circular references

CVE-2026-49451 · published 4 months ago
Summary

The Microsoft OpenAPI library used to read OpenAPI files can stop working if a document contains a looped reference, causing the program to run out of memory and exit. This affects any application that uses the library to parse OpenAPI JSON or YAML files. Update the library to the latest version to prevent the crash.

What to do
  • Update microsoft microsoft.openapi to version 2.7.5.
  • Update microsoft microsoft.openapi to version 3.5.4.
Affected software
Ecosystem VendorProductAffected versions
nuget microsoft microsoft.openapi >= 2.0.0-preview11, <= 2.7.4
>= 3.0.0, <= 3.5.3
Fix: upgrade to 2.7.5
nuget microsoft microsoft.openapi >= 2.0.0-preview.11, <= 2.7.4
Fix: upgrade to 2.7.5
Original advisory text
Microsoft.OpenAPI: Circular schema references may terminate OpenAPI parsing
The OpenAPI.NET SDK contains a useful object model for OpenAPI documents in .NET along with common serializers to extract raw OpenAPI JSON and YAML documents from the model. From 2.0.0-preview11 until 2.7.5 and 3.5.4, a small OpenAPI document containing a circular schema reference can cause process termination through stack overflow in Microsoft.OpenApi. The issue affects OpenAPI document parsing through public OpenAPI.NET reader APIs and has been confirmed across both JSON and YAML reader paths. This vulnerability is fixed in 2.7.5 and 3.5.4.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
7.5 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-674Uncontrolled Recursion
Timeline
Published30 Jun 2026
Updated4 Nov 2026
First seen30 Jun 2026
Sources
GHSA-v5pm-xwqc-g5wc · GHSA
CVE-2026-49451 · NVD
CVE-2026-49451 · OSV
Track software like this
Free during beta