CVE Intelligence
Analysis AI-assisted

CVE-2026-40324: Hot Chocolate GraphQL Parser Uncontrolled Recursion Denial of Service

Hot Chocolate, an open-source GraphQL server for .NET, has a parser without a recursion depth limit, so deeply nested GraphQL documents can overflow the stack and terminate the worker process. The record assigns a CVSS score of 9.1 and describes fixes in the 12.22.7, 13.9.16, 14.3.1 and 15.1.14 releases. No confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

Hot Chocolate is an open-source GraphQL server for .NET. According to the record, its recursive descent parser Utf8GraphQLParser does not enforce a recursion depth limit, a weakness classified as CWE-674 (Uncontrolled Recursion). Parsing happens before validation rules run, so validation-based controls do not stop the problem. The fix is described in the GitHub security advisory.

Impact

  • A crafted GraphQL document with deep nesting can exhaust the call stack of the server process.
  • In .NET a StackOverflowException cannot be caught, so the whole worker process terminates.
  • In-flight HTTP requests, background IHostedService tasks and open WebSocket subscriptions on that worker are dropped until the orchestrator restarts it.
  • The CVSS vector in the record marks confidentiality as none and integrity and availability as high. The description focuses on availability disruption.

Affected products and versions

  • Product: Hot Chocolate, the GraphQL server maintained by ChilliCream.
  • The description states that versions before 12.22.7, 13.9.16, 14.3.1 and 15.1.14 are affected. Release notes exist for 12.22.7, 13.9.16, 14.3.1 and 15.1.14.
  • The structured affected and fixed fields in the record are empty, so exact package ranges per major branch are not confirmed here.

Exploitation status

  • The record does not list this CVE in the CISA KEV catalog.
  • No confirmed exploitation in the wild appears in the sources consulted.
  • The EPSS probability in the record is 0.01048 (about 1.05 percent) with percentile 0.63329. EPSS is a predictive estimate and is not evidence of exploitation.

Remediation and mitigation

  • Upgrade to the patched release for your branch: 12.22.7, 13.9.16, 14.3.1 or 15.1.14.
  • According to the record, no application-level workaround exists, because StackOverflowException cannot be caught in .NET.
  • Limiting request body size at a reverse proxy or load balancer can reduce exposure but does not eliminate it, since the smallest crashing payload described is well below common limits.
  • Confirm that the orchestrator restart policy is configured, which limits downtime but does not prevent the crash.

Detection guidance

  • Monitor for unexpected worker process restarts, crash dumps and sudden drops in active connections or WebSocket sessions.
  • Review gateway logs for unusually large GraphQL request bodies, at a general level, and correlate them with worker restarts.
  • Maintain an inventory of Hot Chocolate versions across services so unpatched instances are identified.

Limitations of the available information

  • The affected and fixed fields in the record are empty, so the analysis relies on the description text.
  • The default value of the new MaxAllowedRecursionDepth option is not stated in the record.
  • The source status is Deferred, so further enrichment may follow.
  • The EPSS date in the record is later than the publication date. The value is reported as recorded.
  • Technical details that would help build an attack are intentionally omitted.

Frequently asked questions

Which Hot Chocolate versions are described as affected?

The record says versions before 12.22.7, 13.9.16, 14.3.1 and 15.1.14 are affected, with fixes in those releases.

Is there a workaround that does not require an upgrade?

According to the record, there is no application-level workaround. Limiting request body size at the proxy or load balancer can reduce risk but does not eliminate it.

Is this vulnerability known to be exploited in the wild?

The record does not list it in CISA KEV, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.