PT-2026-33381 · Unknown · Hot Chocolate

Published 2026-04-16 · Updated 2026-04-19 · CVE-2026-40324

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Hot Chocolate versions prior to 12.22.7 Hot Chocolate versions prior to 13.9.16 Hot Chocolate versions prior to 14.3.1 Hot Chocolate versions prior to 15.1.14

Description The recursive descent parser Utf8GraphQLParser lacks a recursion depth limit. A crafted GraphQL document containing deeply nested selection sets, object values, list values, or list types can trigger a StackOverflowException with payloads as small as 40 KB. Since this exception is uncatchable in .NET, the entire worker process is terminated immediately, dropping all in-flight HTTP requests, background IHostedService tasks, and open WebSocket subscriptions. This crash occurs during the Utf8GraphQLParser.Parse function call, which happens before validation rules such as MaxExecutionDepth, complexity analyzers, or custom IDocumentValidatorRule implementations are executed. The MaxAllowedFields limit is ineffective as the crashing payloads require very few fields.

Recommendations Update to version 12.22.7 or later. Update to version 13.9.16 or later. Update to version 14.3.1 or later. Update to version 15.1.14 or later. Limit HTTP request body size at the reverse proxy or load balancer layer to reduce risk.

Fix

DoS

Uncontrolled Recursion

Weakness Enumeration

CWE-674

Related Identifiers

CVE-2026-40324

GHSA-QR3M-XW4C-JQW3

Affected Products

Hot Chocolate

References · 19

• https://osv.dev/vulnerability/GHSA-qr3m-xw4c-jqw3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40324 · Security Note
• https://github.com/ChilliCream/graphql-platform/pull/9531 · Note
• https://github.com/ChilliCream/graphql-platform/pull/9530 · Note
• https://github.com/ChilliCream/graphql-platform/commit/4cbaf67d366f800fc1e484bc5c06dfcf27b45023 · Note
• https://github.com/ChilliCream/graphql-platform/releases/tag/15.1.14 · Note
• https://github.com/ChilliCream/graphql-platform/commit/08c0caa42ca33c121bbed49d2db892e5bf6fb541 · Note
• https://github.com/ChilliCream/graphql-platform/releases/tag/12.22.7 · Note
• https://github.com/ChilliCream/graphql-platform/commit/b9271e6a500484c002fd528dcd34d1a9b445480f · Note
• https://github.com/ChilliCream/graphql-platform/releases/tag/13.9.16 · Note
• https://github.com/ChilliCream/graphql-platform/releases/tag/14.3.1 · Note
• https://github.com/ChilliCream/graphql-platform/commit/b185eb276c9ee227bd44616ff113be7f01a66c69 · Note
• https://github.com/ChilliCream/graphql-platform/pull/9528 · Note
• https://github.com/ChilliCream/graphql-platform · Note
• https://github.com/ChilliCream/graphql-platform/security/advisories/GHSA-qr3m-xw4c-jqw3 · Note