Detections
Analytics

SCA: security update for Microsoft.OpenApi.Readers, Microsoft.OpenApi.YamlReader (GHSA-7pxr-59rr-hqj2)

high Tenable Cloud Security Plugin ID 474618

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - The OpenAPI.NET SDK contains a useful object model for OpenAPI documents in .NET along with common
 serializers to extract raw OpenAPI JSON and YAML documents from the model. In Microsoft.OpenApi.Readers
 versions before 1.6.30 and Microsoft.OpenApi.YamlReader from 2.0.0-preview.11 through 2.11.0 and 3.0.0
 through 3.9.0, parsing a YAML OpenAPI document with nested anchors and aliases can consume uncontrolled
 memory. SharpYaml represents aliases as shared nodes in a small directed acyclic graph, but conversion to
 independent OpenAPI or System.Text.Json.Nodes.JsonNode trees duplicates every aliased path; without a
 node-count or nesting-depth limit, N nested anchors referenced k times can require k^N materialized nodes
 and terminate the process through an out-of-memory condition. The fixed readers bound materialization to
 5,000,000 nodes and a nesting depth of 64 by default and report an OpenApiDiagnostic error when a limit is
 exceeded. This vulnerability is fixed in Microsoft.OpenApi.Readers 1.6.30 and Microsoft.OpenApi.YamlReader
 2.12.0 and 3.10.0. (CVE-2026-72923)

Solution

Update the Microsoft.OpenApi.Readers library and its related packages to version 1.6.30 or later.

See Also

https://github.com/advisories/GHSA-7pxr-59rr-hqj2

Plugin Details

Severity: High

ID: 474618

Version: Revision 1.2

Type: Local

Family: SCA Checks

Published: 10/14/2026

Updated: 10/16/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.61

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-72923

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/14/2026

Vulnerability Publication Date: 9/8/2026

Reference Information

CVE: CVE-2026-72923