GHSA/CVE-2025-49451: Microsoft OpenAPI.NET Circular Schema Reference DoS

Vulnerability Overview Vulnerability Name: Circular schema references may terminate OpenAPI parsing Vulnerability ID: GHSA-g5gm-xwqc-g5wc Severity: High (7.5 / 10) CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Confidentiality: None - Integrity: None - Availability: High CVE ID: CVE-2025-49451 CWE ID: CWE-674 Description: A small OpenAPI document containing circular schema references can cause the process to terminate via a stack overflow. This issue affects the parsing of OpenAPI documents through the public OpenAPI.NET reader API and has been confirmed in both JSON and YAML reader paths. Impact Scope Affected Versions: - - Impact: Applications, CLIs, development tools, or services that parse untrusted OpenAPI documents within a process may be terminated by a maliciously crafted OpenAPI document containing circular schema references. Impact Scope: Availability/process termination only. This report does not claim remote code execution, privilege escalation, credential exposure, privilege uplift, data exposure, or impact on Microsoft-hosted services. Mitigation Patches: - For the 2.X major version, versions 2.7.5 and later are patched. - For the 3.X major version, versions 3.5.4 and later are patched. - For the 1.X major version, the issue is not applicable because libraries in this version cannot parse references pointing to other references. Recommendation: Users should upgrade to Microsoft OpenAPI 2.7.5 or 3.5.4, depending on their primary version line. Additional Recommendation: Applications parsing OpenAPI documents from untrusted sources should, where possible, avoid parsing them within the main application process. Running the parser in an isolated process can reduce the blast radius of parser failures. Example Payload

Goal Reached Thanks to every supporter — we hit 100%!

GHSA/CVE-2025-49451: Microsoft OpenAPI.NET Circular Schema Reference DoS

More from this source