Uncontrolled resource consumption via YAML anchor and alias expansion in "yamlutils.YAMLToJSON" in github.com/go-openapi/swag/yamlutils. YAMLToJSON walks the low-level yaml.Node tree itself to preserve key order and resolves anchor and alias references in the AliasNode case by re-walking and re-expanding the aliased subtree on every reference, with no bound. go.yaml.in/yaml/v3 guards against this, but its guard only runs when decoding into Go values; decoding into a *yaml.Node short-circuits that walk, so the guard never engages. A sub-kilobyte document with a chain of anchors each referencing the previous one therefore expands exponentially and exhausts memory. Fixed in v0.27.1, which reproduces the library excessive-aliasing guard and adds alias cycle detection. The same unbounded expansion is present in the pre-split root module github.com/go-openapi/swag from v0.22.0, where the code lived in yaml.go until v0.24.0.