Critical, CVSS 9.1NuGetPublished
ChilliCream GraphQL Platform: Utf8GraphQLParser Stack Overflow via Deeply Nested GraphQL Documents
CVE-2026-40324 · GHSA-qr3m-xw4c-jqw3
- Affected
- NuGet hotchocolate.language < 12.22.7; >= 13.0.0, < 13.9.16; >= 14.0.0, < 14.3.1; >= 15.0.0, < 15.1.14
- Fixed in
- 13.9.1615.1.1414.3.112.22.7· Vendor fix available
- Issue
- Impact Hot Chocolate's Utf8GraphQLParser is a recursive descent parser with no recursion depth limit. A crafted GraphQL document with deeply nested selection sets, object values, list values, or list types can trigger a StackOverflowException on payloads as small as 40 KB. Because StackOverflowException is uncatchable in .NET (since .NET 2.0), the entire worker process is terminated immediately. All in-flight HTTP requests, background IHostedService tasks, and open WebSocket subscriptions on that worker are dropped. The orchestrator (Kubernetes, IIS, etc.) must restart the process. This occurs before any validation rules run — MaxExecutionDepth, complexity analyzers, persisted query allow-lists, and custom IDocumentValidatorRule implementations cannot intercept the crash because Utf8GraphQLParser.Parse is invoked before validation. The existing MaxAllowedFields=2048 limit does not help because the crashing payloads contain very few fields. Severity: Critical (9.1) —…
Recommended action: Upgrade to 15.1.14, 14.3.1, 13.9.16 or 12.22.7 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.