Stack overflow via deeply nested documents in Hot Chocolate Utf8GraphQLParser (CVE-2026-40324)

Hot Chocolate's `Utf8GraphQLParser` is a recursive descent parser with no recursion depth limit. A crafted GraphQL document with deeply nested selection sets, object values, list values, or list types triggers an uncatchable `StackOverflowException` in .NET, immediately terminating the entire worker process. This occurs before any validation rules execute, meaning no application-level mitigations can intercept the crash. Affected versions: - < 15.1.14 We recommend updating to: 12.22.7, 13.9.16, 14.3.1, 15.1.14. CVSS 9.1 · our assessment: act_now Reference: https://github.com/ChilliCream/graphql-platform/security/advisories/GHSA-qr3m-xw4c-jqw3 Details: https://vuln.today/cve/CVE-2026-40324