Detections
Analytics

SCA: security update for Microsoft.OpenApi.Readers, Microsoft.OpenApi.YamlReader (GHSA-7pxr-59rr-hqj2)

high Tenable Cloud Security Plugin ID 474618

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In Microsoft.OpenApi.YamlReader from 2.0.0-preview.11 until 2.12.0 and from 3.0.0 until 3.10.0, and in
 Microsoft.OpenApi.Readers prior to 1.6.30, a small YAML OpenAPI document containing nested anchors and
 aliases can cause uncontrolled resource consumption when parsed through the public YAML reader APIs. YAML
 is parsed through SharpYaml, which represents aliases as shared nodes in a directed acyclic graph, so the
 parsed YAML graph stays small, but converting that graph to System.Text.Json.Nodes.JsonNode requires every
 alias to be materialized as an independent node because a JsonNode cannot be attached to multiple parents.
 Without a bound on that conversion work, a document with N nested anchors each referenced k times can
 require k^N materialized JSON nodes, leading to excessive memory allocation and process termination
 through out-of-memory conditions, a billion laughs style denial of service. The patched versions bound the
 YAML-to-JSON conversion by node count and nesting depth and report an OpenApiDiagnostic error instead of
 expanding without limit. This vulnerability is fixed in Microsoft.OpenApi.YamlReader 2.12.0 and 3.10.0,
 and Microsoft.OpenApi.Readers 1.6.30. (CVE-2026-72923)

Solution

Update the Microsoft.OpenApi.Readers library and its related packages to version 1.6.30 or later.

See Also

https://github.com/advisories/GHSA-7pxr-59rr-hqj2

Plugin Details

Severity: High

ID: 474618

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 10/14/2026

Updated: 10/14/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.61

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-72923

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/14/2026

Vulnerability Publication Date: 9/8/2026

Reference Information

CVE: CVE-2026-72923