CVE-2026-49451: OpenAPI.NET SDK Stack Overflow Denial of Service Vulnerability

Technical summary

CVE-2026-49451 is a stack overflow vulnerability in the Microsoft.OpenApi namespace of the OpenAPI.NET SDK. The root cause is improper handling of circular schema references during document parsing. When the reader encounters a schema that references itself directly or indirectly, the recursive parsing logic fails to detect the cycle and continues allocating stack frames until stack memory is exhausted, triggering an unhandled StackOverflowException. The vulnerability is present in both the JSON and YAML deserialization code paths, meaning neither format provides protection. The affected version range spans from 2.0.0-preview11 through 2.7.5 (2.x line) and through 3.5.4 (3.x line). Remediation is available in OpenAPI.NET SDK versions 2.7.5 and 3.5.4 and later.

Business impact

Organizations using the OpenAPI.NET SDK to ingest and validate OpenAPI specifications face availability risk. If your application automatically parses OpenAPI documents from external sources—such as API marketplaces, customer-supplied specifications, or federated API registries—an attacker can submit a malicious document that crashes your service. For development and CI/CD environments, this could disrupt deployment pipelines. In production API gateway or service discovery scenarios, it could lead to unexpected service downtime. The impact is limited to denial of service; confidentiality and integrity are not affected.

Affected systems

Any .NET application or service that imports and uses the OpenAPI.NET SDK (Microsoft.OpenApi NuGet package) in versions 2.0.0-preview11 through 2.7.5, or 3.0.0 through 3.5.4, is at risk if it parses OpenAPI documents from untrusted sources. This includes API design tools, API documentation generators, API gateway configuration loaders, and automated OpenAPI validation tools. Organizations should inventory their .NET projects' dependencies to identify usage of the affected SDK versions.

Exploitability

This vulnerability is straightforward to exploit and requires no authentication or user interaction. An attacker simply crafts a small OpenAPI document with a circular schema reference and submits it for parsing. No special network privileges are needed; the attack vector is network-based and the complexity is low. The barrier to exploitation is minimal—the malicious document can be created with basic knowledge of OpenAPI schema structure. However, exploitability depends on whether the target system accepts and parses OpenAPI documents from untrusted or semi-trusted sources. Systems that only parse internally-controlled, validated OpenAPI specifications face lower practical risk.

Remediation

Upgrade the OpenAPI.NET SDK to version 2.7.5 or later (for the 2.x line) or version 3.5.4 or later (for the 3.x line). These versions include fixes for circular schema reference handling that prevent stack overflow. Before upgrading, verify compatibility with your application's .NET framework target and any dependent packages. Test the upgrade in a staging environment to ensure no breaking changes affect your API parsing workflows.

Patch guidance

To apply this patch: (1) Update your project's NuGet package reference for Microsoft.OpenApi to version 2.7.5 or 3.5.4 or later. (2) If your project uses a packages.config or .csproj file, modify the version constraint to allow the fixed versions. (3) Run 'dotnet restore' or 'nuget restore' to pull the patched package. (4) Rebuild your application and re-run your test suite to confirm functionality. (5) Deploy the updated application to your environment. For projects unable to immediately upgrade, consider implementing input validation to reject OpenAPI documents with detected circular references, though this is a temporary workaround and not a substitute for patching.

Detection guidance

Monitor application logs for StackOverflowException errors originating from the Microsoft.OpenApi namespace, particularly during OpenAPI document parsing operations. If you are processing OpenAPI documents from external sources, add schema validation rules that detect and reject documents with circular schema references before they reach the SDK parser. In development environments, perform fuzzing or property-based testing of your OpenAPI parsing code with intentionally malformed documents. Review your dependency inventory to identify all projects using the OpenAPI.NET SDK and their current versions.

Why prioritize this

This vulnerability merits prompt attention due to its high CVSS score (7.5), network-accessible attack vector, and lack of required authentication or user interaction. While impact is limited to availability, the ease of exploitation and the prevalence of OpenAPI in modern API ecosystems mean organizations with public or partner-facing API specifications should prioritize patching. However, organizations whose systems parse only internal, controlled OpenAPI documents may defer this patch based on their risk tolerance and internal controls.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects a network-accessible denial-of-service vulnerability with no privileges or user interaction required. The attack complexity is low because the attacker only needs to craft a valid OpenAPI document with a circular schema reference—no special conditions or race conditions are needed. The scope is unchanged (attack is limited to the vulnerable component), and there is no impact to confidentiality or integrity. The high impact to availability reflects the ability to completely crash the parsing process. This severity is appropriate for a denial-of-service flaw in a widely-used library.

Frequently asked questions