CVE-2026-49451CWE-674

Microsoft.OpenAPI: Circular schema references may terminate OpenAPI parsing

High · published June 30, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
68.9
In the wild
Unconfirmed
What it is

The OpenAPI.NET SDK contains a useful object model for OpenAPI documents in .NET along with common serializers to extract raw OpenAPI JSON and YAML documents from the model. From 2.0.0-preview11 until 2.7.5 and 3.5.4, a small OpenAPI document containing a circular schema reference can cause process termination through stack overflow in Microsoft.OpenApi. The issue affects OpenAPI document parsing through public OpenAPI.NET reader APIs and has been confirmed across both JSON and YAML reader paths. This vulnerability is fixed in 2.7.5 and 3.5.4.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.01238 · 68.9th percentile
Weakness
CWE-674 · Uncontrolled Recursion
Published
2026-06-30T16:01Z
EPSS history
Timeline
  • 30 JUN 16:01Z
    Microsoft.OpenAPI: Circular schema references may terminate OpenAPI parsing
    cvelistv5