The `Microsoft.AspNetCore.OpenApi` nuget package version 10.0.x nuget dependency to `Microsoft.OpenApi` v2.0.0 is incorrect and it should be constrained

[eriawan]

Is there an existing issue for this?

• I have searched the existing issues

Describe the bug

The Microsoft.AspNetCore.OpenApi nuget package version 10.0.x by default refers to Microsoft.OpenApi version 2.0.0, which is not secured, but at the same time it cannot depend to Microsoft.OpenApi v3.0.0 or later as these versions has breaking changes. Therefore Microsoft.AspNetCore.OpenApi nuget package version 10.0.x nuget dependency is incorrect, and it should be constrained.

This issue is not duplicate of #67505 because that issue only concerns of having dependency to Microsoft.OpenApi v2.0.0 that has CVE.

For example, looking at the Microsoft.AspNetCore.OpenApi nuget in nuget package manager in Visual Studio, it shows it needs Microsoft.OpenApi v2.0.0 or later:

Looking at the Microsoft.OpenApi v2.0.0 nuget package, it has security vulnerability: GHSA-v5pm-xwqc-g5wc

Unfortunately, the reference to Microsoft.OpenApi says that it refers to v2.0.0 or later, and this is also incorrect as the Microsoft.OpenApi v3.0.0 or later is not compatible with Microsoft.AspNetCore.OpenApi before v11.0.x, as it has been discussed in previous issue: #64317 and it is also documented in MS Learn doc: https://learn.microsoft.com/en-us/aspnet/core/breaking-changes/11/microsoft-openapi-3x?view=aspnetcore-10.0.

We should also consider the fact that Microsoft.OpenApi version after 2.7.4 is correctly patched:

Expected Behavior

1. The use of Microsoft.AspNetCore.OpenApi v10.0.x should not depend on Microsoft.OpenApi v2.0.0 by default, because it has security vulnerability
2. The Microsoft.AspNetCore.OpenApi should depend on Microsoft.OpenApi v2.7.5 or later as indicated in the GitHub adversary above but it must not refer to v3.0.0 or later because v3.0.0 has breaking change
3. Therefore, Microsoft.AspNetCore.OpenApi v10.0.x should also prevent or even better, must limit the max version dependency to Microsoft.OpenApi to use version less than Microsoft.OpenApi v3.0.0, for example, the version dependency should be like this:

<PackageReference Include="Microsoft.OpenApi" Version="(2.7.4,3.0.0)" />

Steps To Reproduce

1. Create any C# project that target .NET 10.0 and add nuget reference of Microsoft.AspNetCore.OpenApi version 10.0..x
2. Compile

Exceptions (if any)

No response

.NET Version

10.0.302

Anything else?

.NET SDK used: 10.0.110 and 10.0.302 (but any .NET SDK 10.0.x is reproducible)
IDE: VS 2026 18.7.0

[Youssef1313]

This has been fixed recently:

https://github.com/dotnet/aspnetcore/blob/release/10.0/eng/Versions.props#L182-L183

PRs: #67464 and #67772