Microsoft.AspNetCore.OpenApi nuget has dependency on Microsoft.OpenAPI with CVE-2026-49451

[LiorBanai]

nuget Microsoft.AspNetCore.OpenApi depends on Microsoft.OpenAPI which itself has CVE-2026-49451.

Updating transitive nuget to 3.7.0 breaks compilation:

[martincostello]

See #67464.

You should update to 2.7.5 (latest 2.x is 2.9.0) for CVE fixes.

[Youssef1313]

Thanks @LiorBanai

We are on it already. For now, you need to manually update to a newer 2.x version. The earliest patched version is 2.7.5.

Updating to 3.x cannot work as 3.x is a breaking change release (indicating by the major version)

[LiorBanai]

@Youssef1313 thanks. I think i can wait for the fix directly from Microsoft.AspNetCore.OpenApi nuget instead of adding the transive package as direct package.
will the fix be in the coming release or later (11 August)?

[Youssef1313]

Hopefully we will be able to get it in August servicing.

[martincostello]

Personally I would recommend adding your own reference anyway (regardless of the CVEs) so that you always get the latest features and bug fixes (because ASP.NET Core won't always update to the latest version).