GHSA-7pxr-59rr-hqj2Published

Microsoft.OpenApi.YamlReader vulnerable to denial of service via YAML alias expansion

Exact source revision recorded 23 Oct 2026 16:01:25 UTC. It does not establish the source's current position. Latest evidence.

Recorded JSON

osv · GHSA-7pxr-59rr-hqj2

Published

Microsoft.OpenApi.YamlReader

NuGet

ECOSYSTEM · introduced 3.0.0 → fixed 3.10.0

21 explicitly affected versions

3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.1.1, 3.1.2, 3.1.3, 3.2.0, 3.3.0, 3.3.1, 3.4.0, 3.5.0, 3.5.1, 3.5.2, 3.5.3, 3.5.4, 3.5.5, 3.6.0, 3.7.0, 3.8.0, 3.9.0

Microsoft.OpenApi.YamlReader

NuGet

ECOSYSTEM · introduced 2.0.0-preview.11 → fixed 2.12.0

35 explicitly affected versions

2.0.0, 2.0.1, 2.1.0, 2.10.0, 2.11.0, 2.2.0, 2.3.0, 2.3.1, 2.3.10, 2.3.11, 2.3.12, 2.3.2, 2.3.3, 2.3.4, 2.3.5, 2.3.6, 2.3.7, 2.3.8, 2.3.9, 2.4.0, 2.4.1, 2.4.2, 2.4.3, 2.5.0, 2.6.0, 2.6.1, 2.7.0, 2.7.1, 2.7.2, 2.7.3, 2.7.4, 2.7.5, 2.7.6, 2.8.0, 2.9.0

Microsoft.OpenApi.Readers

NuGet

ECOSYSTEM · introduced 0 → fixed 1.6.30

71 explicitly affected versions

1.0.0, 1.0.0-beta008, 1.0.0-beta009, 1.0.0-beta010, 1.0.0-beta011, 1.0.0-beta012, 1.0.0-beta013, 1.0.0-beta014, 1.0.0-beta015, 1.0.0-beta016, 1.0.0-beta017, 1.0.1, 1.1.0, 1.1.1, 1.1.2, 1.1.3, 1.1.4, 1.2.0, 1.2.0-preview, 1.2.1, 1.2.2, 1.2.3, 1.3.0-preview, 1.3.1, 1.3.1-preview4, 1.3.1-preview5, 1.3.1-preview6, 1.3.2, 1.4.0, 1.4.0-preview1, 1.4.0-preview2, 1.4.0-preview3, 1.4.1, 1.4.4, 1.4.4-preview1, 1.4.5, 1.5.0, 1.6.0, 1.6.1, 1.6.10, 1.6.11, 1.6.12, 1.6.13, 1.6.14, 1.6.15, 1.6.16, 1.6.17, 1.6.18, 1.6.19, 1.6.2, 1.6.20, 1.6.21, 1.6.22, 1.6.23, 1.6.24, 1.6.25, 1.6.26, 1.6.27, 1.6.28, 1.6.29, 1.6.3, 1.6.4, 1.6.4-preview1, 1.6.4-preview2, 1.6.4-preview3, 1.6.4-preview4, 1.6.5, 1.6.6, 1.6.7, 1.6.8, 1.6.9

Original source record · Cite this exact observation · Complete original publisher JSON