CVE-2026-40324

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-40324", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-10T21:41:54.505Z", "datePublished": "2026-04-17T23:05:26.217Z", "dateUpdated": "2026-04-20T16:16:25.151Z"}, "containers": {"cna": {"title": "Hot Chocolate's Utf8GraphQLParser has Stack Overflow via Deeply Nested GraphQL Documents", "problemTypes": [{"descriptions": [{"cweId": "CWE-674", "lang": "en", "description": "CWE-674: Uncontrolled Recursion", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/ChilliCream/graphql-platform/security/advisories/GHSA-qr3m-xw4c-jqw3", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/ChilliCream/graphql-platform/security/advisories/GHSA-qr3m-xw4c-jqw3"}, {"name": "https://github.com/ChilliCream/graphql-platform/pull/9528", "tags": ["x_refsource_MISC"], "url": "https://github.com/ChilliCream/graphql-platform/pull/9528"}, {"name": "https://github.com/ChilliCream/graphql-platform/pull/9530", "tags": ["x_refsource_MISC"], "url": "https://github.com/ChilliCream/graphql-platform/pull/9530"}, {"name": "https://github.com/ChilliCream/graphql-platform/pull/9531", "tags": ["x_refsource_MISC"], "url": "https://github.com/ChilliCream/graphql-platform/pull/9531"}, {"name": "https://github.com/ChilliCream/graphql-platform/commit/08c0caa42ca33c121bbed49d2db892e5bf6fb541", "tags": ["x_refsource_MISC"], "url": "https://github.com/ChilliCream/graphql-platform/commit/08c0caa42ca33c121bbed49d2db892e5bf6fb541"}, {"name": "https://github.com/ChilliCream/graphql-platform/commit/4cbaf67d366f800fc1e484bc5c06dfcf27b45023", "tags": ["x_refsource_MISC"], "url": "https://github.com/ChilliCream/graphql-platform/commit/4cbaf67d366f800fc1e484bc5c06dfcf27b45023"}, {"name": "https://github.com/ChilliCream/graphql-platform/commit/b185eb276c9ee227bd44616ff113be7f01a66c69", "tags": ["x_refsource_MISC"], "url": "https://github.com/ChilliCream/graphql-platform/commit/b185eb276c9ee227bd44616ff113be7f01a66c69"}, {"name": "https://github.com/ChilliCream/graphql-platform/commit/b9271e6a500484c002fd528dcd34d1a9b445480f", "tags": ["x_refsource_MISC"], "url": "https://github.com/ChilliCream/graphql-platform/commit/b9271e6a500484c002fd528dcd34d1a9b445480f"}, {"name": "https://github.com/ChilliCream/graphql-platform/releases/tag/12.22.7", "tags": ["x_refsource_MISC"], "url": "https://github.com/ChilliCream/graphql-platform/releases/tag/12.22.7"}, {"name": "https://github.com/ChilliCream/graphql-platform/releases/tag/13.9.16", "tags": ["x_refsource_MISC"], "url": "https://github.com/ChilliCream/graphql-platform/releases/tag/13.9.16"}, {"name": "https://github.com/ChilliCream/graphql-platform/releases/tag/14.3.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/ChilliCream/graphql-platform/releases/tag/14.3.1"}, {"name": "https://github.com/ChilliCream/graphql-platform/releases/tag/15.1.14", "tags": ["x_refsource_MISC"], "url": "https://github.com/ChilliCream/graphql-platform/releases/tag/15.1.14"}], "affected": [{"vendor": "ChilliCream", "product": "graphql-platform", "versions": [{"version": "< 12.22.7", "status": "affected"}, {"version": ">= 13.0.0, < 13.9.16", "status": "affected"}, {"version": ">= 14.0.0, < 14.3.1", "status": "affected"}, {"version": ">= 15.0.0, < 15.1.14", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-17T23:05:26.217Z"}, "descriptions": [{"lang": "en", "value": "Hot Chocolate is an open-source GraphQL server. Prior to versions 12.22.7, 13.9.16, 14.3.1, and 15.1.14, Hot Chocolate's recursive descent parser `Utf8GraphQLParser` has no recursion depth limit. A crafted GraphQL document with deeply nested selection sets, object values, list values, or list types can trigger a `StackOverflowException` on payloads as small as 40 KB. Because `StackOverflowException` is uncatchable in .NET (since .NET 2.0), the entire worker process is terminated immediately. All in-flight HTTP requests, background `IHostedService` tasks, and open WebSocket subscriptions on that worker are dropped. The orchestrator (Kubernetes, IIS, etc.) must restart the process. This occurs before any validation rules run \u2014 `MaxExecutionDepth`, complexity analyzers, persisted query allow-lists, and custom `IDocumentValidatorRule` implementations cannot intercept the crash because `Utf8GraphQLParser.Parse` is invoked before validation. The `MaxAllowedFields=2048` limit does not help because the crashing payloads contain very few fields. The fix in versions 12.22.7, 13.9.16, 14.3.1, and 15.1.14 adds a `MaxAllowedRecursionDepth` option to `ParserOptions` with a safe default, and enforces it across all recursive parser methods (`ParseSelectionSet`, `ParseValueLiteral`, `ParseObject`, `ParseList`, `ParseTypeReference`, etc.). When the limit is exceeded, a catchable `SyntaxException` is thrown instead of overflowing the stack. There is no application-level workaround. `StackOverflowException` cannot be caught in .NET. The only mitigation is to upgrade to a patched version. Operators can reduce (but not eliminate) risk by limiting HTTP request body size at the reverse proxy or load balancer layer, though the smallest crashing payload (40 KB) is well below most default body size limits and is highly compressible (~few hundred bytes via gzip)."}], "source": {"advisory": "GHSA-qr3m-xw4c-jqw3", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-20T16:14:16.099717Z", "id": "CVE-2026-40324", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-20T16:16:25.151Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-40324", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-20T16:14:16.099717Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-20T16:14:23.245Z"}}], "cna": {"title": "Hot Chocolate's Utf8GraphQLParser has Stack Overflow via Deeply Nested GraphQL Documents", "source": {"advisory": "GHSA-qr3m-xw4c-jqw3", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "ChilliCream", "product": "graphql-platform", "versions": [{"status": "affected", "version": "< 12.22.7"}, {"status": "affected", "version": ">= 13.0.0, < 13.9.16"}, {"status": "affected", "version": ">= 14.0.0, < 14.3.1"}, {"status": "affected", "version": ">= 15.0.0, < 15.1.14"}]}], "references": [{"url": "https://github.com/ChilliCream/graphql-platform/security/advisories/GHSA-qr3m-xw4c-jqw3", "name": "https://github.com/ChilliCream/graphql-platform/security/advisories/GHSA-qr3m-xw4c-jqw3", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/ChilliCream/graphql-platform/pull/9528", "name": "https://github.com/ChilliCream/graphql-platform/pull/9528", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/ChilliCream/graphql-platform/pull/9530", "name": "https://github.com/ChilliCream/graphql-platform/pull/9530", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/ChilliCream/graphql-platform/pull/9531", "name": "https://github.com/ChilliCream/graphql-platform/pull/9531", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/ChilliCream/graphql-platform/commit/08c0caa42ca33c121bbed49d2db892e5bf6fb541", "name": "https://github.com/ChilliCream/graphql-platform/commit/08c0caa42ca33c121bbed49d2db892e5bf6fb541", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/ChilliCream/graphql-platform/commit/4cbaf67d366f800fc1e484bc5c06dfcf27b45023", "name": "https://github.com/ChilliCream/graphql-platform/commit/4cbaf67d366f800fc1e484bc5c06dfcf27b45023", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/ChilliCream/graphql-platform/commit/b185eb276c9ee227bd44616ff113be7f01a66c69", "name": "https://github.com/ChilliCream/graphql-platform/commit/b185eb276c9ee227bd44616ff113be7f01a66c69", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/ChilliCream/graphql-platform/commit/b9271e6a500484c002fd528dcd34d1a9b445480f", "name": "https://github.com/ChilliCream/graphql-platform/commit/b9271e6a500484c002fd528dcd34d1a9b445480f", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/ChilliCream/graphql-platform/releases/tag/12.22.7", "name": "https://github.com/ChilliCream/graphql-platform/releases/tag/12.22.7", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/ChilliCream/graphql-platform/releases/tag/13.9.16", "name": "https://github.com/ChilliCream/graphql-platform/releases/tag/13.9.16", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/ChilliCream/graphql-platform/releases/tag/14.3.1", "name": "https://github.com/ChilliCream/graphql-platform/releases/tag/14.3.1", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/ChilliCream/graphql-platform/releases/tag/15.1.14", "name": "https://github.com/ChilliCream/graphql-platform/releases/tag/15.1.14", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Hot Chocolate is an open-source GraphQL server. Prior to versions 12.22.7, 13.9.16, 14.3.1, and 15.1.14, Hot Chocolate's recursive descent parser `Utf8GraphQLParser` has no recursion depth limit. A crafted GraphQL document with deeply nested selection sets, object values, list values, or list types can trigger a `StackOverflowException` on payloads as small as 40 KB. Because `StackOverflowException` is uncatchable in .NET (since .NET 2.0), the entire worker process is terminated immediately. All in-flight HTTP requests, background `IHostedService` tasks, and open WebSocket subscriptions on that worker are dropped. The orchestrator (Kubernetes, IIS, etc.) must restart the process. This occurs before any validation rules run \u2014 `MaxExecutionDepth`, complexity analyzers, persisted query allow-lists, and custom `IDocumentValidatorRule` implementations cannot intercept the crash because `Utf8GraphQLParser.Parse` is invoked before validation. The `MaxAllowedFields=2048` limit does not help because the crashing payloads contain very few fields. The fix in versions 12.22.7, 13.9.16, 14.3.1, and 15.1.14 adds a `MaxAllowedRecursionDepth` option to `ParserOptions` with a safe default, and enforces it across all recursive parser methods (`ParseSelectionSet`, `ParseValueLiteral`, `ParseObject`, `ParseList`, `ParseTypeReference`, etc.). When the limit is exceeded, a catchable `SyntaxException` is thrown instead of overflowing the stack. There is no application-level workaround. `StackOverflowException` cannot be caught in .NET. The only mitigation is to upgrade to a patched version. Operators can reduce (but not eliminate) risk by limiting HTTP request body size at the reverse proxy or load balancer layer, though the smallest crashing payload (40 KB) is well below most default body size limits and is highly compressible (~few hundred bytes via gzip)."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-674", "description": "CWE-674: Uncontrolled Recursion"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-17T23:05:26.217Z"}}}, "cveMetadata": {"cveId": "CVE-2026-40324", "state": "PUBLISHED", "dateUpdated": "2026-04-20T16:16:25.151Z", "dateReserved": "2026-04-10T21:41:54.505Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-17T23:05:26.217Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "graphql-platform", "vendor": "ChilliCream", "versions": [{"status": "affected", "version": "< 12.22.7"}, {"status": "affected", "version": ">= 13.0.0, < 13.9.16"}, {"status": "affected", "version": ">= 14.0.0, < 14.3.1"}, {"status": "affected", "version": ">= 15.0.0, < 15.1.14"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Hot Chocolate is an open-source GraphQL server. Prior to versions 12.22.7, 13.9.16, 14.3.1, and 15.1.14, Hot Chocolate's recursive descent parser `Utf8GraphQLParser` has no recursion depth limit. A crafted GraphQL document with deeply nested selection sets, object values, list values, or list types can trigger a `StackOverflowException` on payloads as small as 40 KB. Because `StackOverflowException` is uncatchable in .NET (since .NET 2.0), the entire worker process is terminated immediately. All in-flight HTTP requests, background `IHostedService` tasks, and open WebSocket subscriptions on that worker are dropped. The orchestrator (Kubernetes, IIS, etc.) must restart the process. This occurs before any validation rules run \u2014 `MaxExecutionDepth`, complexity analyzers, persisted query allow-lists, and custom `IDocumentValidatorRule` implementations cannot intercept the crash because `Utf8GraphQLParser.Parse` is invoked before validation. The `MaxAllowedFields=2048` limit does not help because the crashing payloads contain very few fields. The fix in versions 12.22.7, 13.9.16, 14.3.1, and 15.1.14 adds a `MaxAllowedRecursionDepth` option to `ParserOptions` with a safe default, and enforces it across all recursive parser methods (`ParseSelectionSet`, `ParseValueLiteral`, `ParseObject`, `ParseList`, `ParseTypeReference`, etc.). When the limit is exceeded, a catchable `SyntaxException` is thrown instead of overflowing the stack. There is no application-level workaround. `StackOverflowException` cannot be caught in .NET. The only mitigation is to upgrade to a patched version. Operators can reduce (but not eliminate) risk by limiting HTTP request body size at the reverse proxy or load balancer layer, though the smallest crashing payload (40 KB) is well below most default body size limits and is highly compressible (~few hundred bytes via gzip)."}, {"lang": "es", "value": "Hot Chocolate es un servidor GraphQL de c\u00f3digo abierto. Antes de las versiones 12.22.7, 13.9.16, 14.3.1 y 15.1.14, el analizador de descenso recursivo de Hot Chocolate Utf8GraphQLParser no tiene l\u00edmite de profundidad de recursi\u00f3n. Un documento GraphQL manipulado con conjuntos de selecci\u00f3n, valores de objeto, valores de lista o tipos de lista profundamente anidados puede desencadenar una StackOverflowException en cargas \u00fatiles tan peque\u00f1as como 40 KB. Debido a que StackOverflowException no se puede capturar en .NET (desde .NET 2.0), el proceso de trabajo completo se termina inmediatamente. Todas las solicitudes HTTP en curso, las tareas de IHostedService en segundo plano y las suscripciones WebSocket abiertas en ese trabajador se descartan. El orquestador (Kubernetes, IIS, etc.) debe reiniciar el proceso. Esto ocurre antes de que se ejecuten las reglas de validaci\u00f3n - MaxExecutionDepth, analizadores de complejidad, listas de permitidos de consultas persistentes e implementaciones personalizadas de IDocumentValidatorRule no pueden interceptar el fallo porque Utf8GraphQLParser.Parse se invoca antes de la validaci\u00f3n. El l\u00edmite MaxAllowedFields=2048 no ayuda porque las cargas \u00fatiles que causan el fallo contienen muy pocos campos. La correcci\u00f3n en las versiones 12.22.7, 13.9.16, 14.3.1 y 15.1.14 a\u00f1ade una opci\u00f3n MaxAllowedRecursionDepth a ParserOptions con un valor predeterminado seguro, y la aplica en todos los m\u00e9todos de analizador recursivos (ParseSelectionSet, ParseValueLiteral, ParseObject, ParseList, ParseTypeReference, etc.). Cuando se excede el l\u00edmite, se lanza una SyntaxException capturable en lugar de desbordar la pila. No hay una soluci\u00f3n alternativa a nivel de aplicaci\u00f3n. StackOverflowException no se puede capturar en .NET. La \u00fanica mitigaci\u00f3n es actualizar a una versi\u00f3n parcheada. Los operadores pueden reducir (pero no eliminar) el riesgo limitando el tama\u00f1o del cuerpo de la solicitud HTTP en la capa del proxy inverso o del equilibrador de carga, aunque la carga \u00fatil m\u00e1s peque\u00f1a que causa el fallo (40 KB) est\u00e1 muy por debajo de la mayor\u00eda de los l\u00edmites predeterminados de tama\u00f1o de cuerpo y es altamente compresible (aproximadamente unos pocos cientos de bytes mediante gzip)."}], "id": "CVE-2026-40324", "lastModified": "2026-10-26T22:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40324", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-20T16:14:16.099717Z", "version": "2.0.3"}}]}, "published": "2026-04-18T00:16:36.920", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/ChilliCream/graphql-platform/commit/08c0caa42ca33c121bbed49d2db892e5bf6fb541"}, {"source": "security-advisories@github.com", "url": "https://github.com/ChilliCream/graphql-platform/commit/4cbaf67d366f800fc1e484bc5c06dfcf27b45023"}, {"source": "security-advisories@github.com", "url": "https://github.com/ChilliCream/graphql-platform/commit/b185eb276c9ee227bd44616ff113be7f01a66c69"}, {"source": "security-advisories@github.com", "url": "https://github.com/ChilliCream/graphql-platform/commit/b9271e6a500484c002fd528dcd34d1a9b445480f"}, {"source": "security-advisories@github.com", "url": "https://github.com/ChilliCream/graphql-platform/pull/9528"}, {"source": "security-advisories@github.com", "url": "https://github.com/ChilliCream/graphql-platform/pull/9530"}, {"source": "security-advisories@github.com", "url": "https://github.com/ChilliCream/graphql-platform/pull/9531"}, {"source": "security-advisories@github.com", "url": "https://github.com/ChilliCream/graphql-platform/releases/tag/12.22.7"}, {"source": "security-advisories@github.com", "url": "https://github.com/ChilliCream/graphql-platform/releases/tag/13.9.16"}, {"source": "security-advisories@github.com", "url": "https://github.com/ChilliCream/graphql-platform/releases/tag/14.3.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/ChilliCream/graphql-platform/releases/tag/15.1.14"}, {"source": "security-advisories@github.com", "url": "https://github.com/ChilliCream/graphql-platform/security/advisories/GHSA-qr3m-xw4c-jqw3"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-674"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,12.22.7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[13.0.0,13.9.16)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[14.0.0,14.3.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[15.0.0,15.1.14)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "graphql-platform", "source": "cna", "vendor": "ChilliCream"}, "product": "graphql-platform", "vendor": "chillicream"}], "analysis": {"en": {"generated_at": "2026-04-18T08:49:59.437996+00:00", "value": {"mitigation_remediation": ["Upgrade Hot Chocolate to version 12.22.7, 13.9.16, 14.3.1, or 15.1.14 where a max recursion depth limit is implemented.", "If an immediate upgrade is not possible, configure your reverse proxy or load balancer to enforce a stricter maximum HTTP request body size and enable compression to limit the size that reaches the parser.", "Ensure your application can handle SyntaxException errors gracefully so that the server remains operational even if a malformed query is received."], "summary": {"action": "Immediate Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "Systems built with the ChilliCream Hot Chocolate GraphQL platform running a version earlier than 12.22.7, 13.9.16, 14.3.1, or 15.1.14 are affected. This includes any .NET application that hosts the Hot Chocolate library to process GraphQL requests. The failure occurs within the application process, regardless of hardware environment.", "description_and_impact": "Hot Chocolate, the GraphQL server library, contains a recursive descent parser with no bound on recursion depth. When an attacker sends a carefully constructed GraphQL document featuring deeply nested selection sets, object values, list values, or list types, the parser can consume an unlimited stack and trigger a StackOverflowException. Because the exception is uncatchable in .NET, the entire worker process terminates, causing all in-flight HTTP requests, background services, and WebSocket subscriptions to fail and requiring the orchestrator to restart the process. The issue is resolved in releases 12.22.7, 13.9.16, 14.3.1, and 15.1.14, which introduce a safe default recursion depth limit and throw a catchable SyntaxException instead of allowing a stack overflow.", "risk_and_exploitability": "The CVSS score of 9.1 indicates a Critical severity. Although the EPSS score is not available, the vulnerability can be exploited with a payload that can be compressed to only a few hundred bytes, easily bypassing typical body size limits. The stack overflow occurs before any GraphQL validation runs, so standard mitigations such as complexity analysis or persisted query whitelisting do not protect the service. An attacker who can send the crafted query can bring the application down without authentication, presenting a high risk of denial of service in production environments."}}}}, "created": "2026-04-18T09:00:05.893347+00:00", "updated": "2026-04-20T14:59:21.534142+00:00", "vendors": ["chillicream", "chillicream$PRODUCT$graphql-platform"]}