Microsoft.OpenApi.YamlReader vulnerable to denial of service via YAML alias expansion

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-72923 · Microsoft / collected KEV context

EUVD-2026-73080

GHSA-7pxr-59rr-hqj2

cve-program · CVE-2026-72923

• https://github.com/microsoft/OpenAPI.NET/security/advisories/GHSA-7pxr-59rr-hqj2
• https://github.com/microsoft/OpenAPI.NET/commit/1f9aea9bdcbf4066b59ce33b3bd8f97ed9cb4766
• https://github.com/microsoft/OpenAPI.NET/commit/21793261d6860fb6e607b71fd95c0bd320724764
• https://github.com/microsoft/OpenAPI.NET/commit/4db9af07d112cdf45170b7a946f956ffe74fa14e

euvd · EUVD-2026-73080

• https://github.com/microsoft/OpenAPI.NET/security/advisories/GHSA-7pxr-59rr-hqj2
• https://github.com/microsoft/OpenAPI.NET/commit/1f9aea9bdcbf4066b59ce33b3bd8f97ed9cb4766
• https://github.com/microsoft/OpenAPI.NET/commit/21793261d6860fb6e607b71fd95c0bd320724764
• https://github.com/microsoft/OpenAPI.NET/commit/4db9af07d112cdf45170b7a946f956ffe74fa14e

nvd · CVE-2026-72923

• https://github.com/microsoft/OpenAPI.NET/commit/1f9aea9bdcbf4066b59ce33b3bd8f97ed9cb4766
• https://github.com/microsoft/OpenAPI.NET/commit/21793261d6860fb6e607b71fd95c0bd320724764
• https://github.com/microsoft/OpenAPI.NET/commit/4db9af07d112cdf45170b7a946f956ffe74fa14e
• https://github.com/microsoft/OpenAPI.NET/security/advisories/GHSA-7pxr-59rr-hqj2

osv · GHSA-7pxr-59rr-hqj2

• https://github.com/microsoft/OpenAPI.NET/security/advisories/GHSA-7pxr-59rr-hqj2
• https://nvd.nist.gov/vuln/detail/CVE-2026-72923
• https://github.com/microsoft/OpenAPI.NET/pull/3000
• https://github.com/microsoft/OpenAPI.NET/pull/3005
• https://github.com/microsoft/OpenAPI.NET/pull/3020
• https://github.com/microsoft/OpenAPI.NET/commit/1f9aea9bdcbf4066b59ce33b3bd8f97ed9cb4766
• https://github.com/microsoft/OpenAPI.NET/commit/21793261d6860fb6e607b71fd95c0bd320724764
• https://github.com/microsoft/OpenAPI.NET/commit/4db9af07d112cdf45170b7a946f956ffe74fa14e
• https://github.com/microsoft/OpenAPI.NET
• https://github.com/microsoft/OpenAPI.NET/releases/tag/v1.6.30
• https://github.com/microsoft/OpenAPI.NET/releases/tag/v2.12.0
• https://github.com/microsoft/OpenAPI.NET/releases/tag/v3.10.0

No related operational record is retained in the current change model.