CVE-2026-40324

{
  "id": "CVE-2026-40324",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-18T00:16:36.920",
  "lastModified": "2026-10-26T22:10:00.163",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Hot Chocolate is an open-source GraphQL server. Prior to versions 12.22.7, 13.9.16, 14.3.1, and 15.1.14, Hot Chocolate's recursive descent parser `Utf8GraphQLParser` has no recursion depth limit. A crafted GraphQL document with deeply nested selection sets, object values, list values, or list types can trigger a `StackOverflowException` on payloads as small as 40 KB. Because `StackOverflowException` is uncatchable in .NET (since .NET 2.0), the entire worker process is terminated immediately. All in-flight HTTP requests, background `IHostedService` tasks, and open WebSocket subscriptions on that worker are dropped. The orchestrator (Kubernetes, IIS, etc.) must restart the process. This occurs before any validation rules run — `MaxExecutionDepth`, complexity analyzers, persisted query allow-lists, and custom `IDocumentValidatorRule` implementations cannot intercept the crash because `Utf8GraphQLParser.Parse` is invoked before validation. The `MaxAllowedFields=2048` limit does not help because the crashing payloads contain very few fields. The fix in versions 12.22.7, 13.9.16, 14.3.1, and 15.1.14 adds a `MaxAllowedRecursionDepth` option to `ParserOptions` with a safe default, and enforces it across all recursive parser methods (`ParseSelectionSet`, `ParseValueLiteral`, `ParseObject`, `ParseList`, `ParseTypeReference`, etc.). When the limit is exceeded, a catchable `SyntaxException` is thrown instead of overflowing the stack. There is no application-level workaround. `StackOverflowException` cannot be caught in .NET. The only mitigation is to upgrade to a patched version. Operators can reduce (but not eliminate) risk by limiting HTTP request body size at the reverse proxy or load balancer layer, though the smallest crashing payload (40 KB) is well below most default body size limits and is highly compressible (~few hundred bytes via gzip)."
    },
    {
      "lang": "es",
      "value": "Hot Chocolate es un servidor GraphQL de código abierto. Antes de las versiones 12.22.7, 13.9.16, 14.3.1 y 15.1.14, el analizador de descenso recursivo de Hot Chocolate Utf8GraphQLParser no tiene límite de profundidad de recursión. Un documento GraphQL manipulado con conjuntos de selección, valores de objeto, valores de lista o tipos de lista profundamente anidados puede desencadenar una StackOverflowException en cargas útiles tan pequeñas como 40 KB. Debido a que StackOverflowException no se puede capturar en .NET (desde .NET 2.0), el proceso de trabajo completo se termina inmediatamente. Todas las solicitudes HTTP en curso, las tareas de IHostedService en segundo plano y las suscripciones WebSocket abiertas en ese trabajador se descartan. El orquestador (Kubernetes, IIS, etc.) debe reiniciar el proceso. Esto ocurre antes de que se ejecuten las reglas de validación - MaxExecutionDepth, analizadores de complejidad, listas de permitidos de consultas persistentes e implementaciones personalizadas de IDocumentValidatorRule no pueden interceptar el fallo porque Utf8GraphQLParser.Parse se invoca antes de la validación. El límite MaxAllowedFields=2048 no ayuda porque las cargas útiles que causan el fallo contienen muy pocos campos. La corrección en las versiones 12.22.7, 13.9.16, 14.3.1 y 15.1.14 añade una opción MaxAllowedRecursionDepth a ParserOptions con un valor predeterminado seguro, y la aplica en todos los métodos de analizador recursivos (ParseSelectionSet, ParseValueLiteral, ParseObject, ParseList, ParseTypeReference, etc.). Cuando se excede el límite, se lanza una SyntaxException capturable en lugar de desbordar la pila. No hay una solución alternativa a nivel de aplicación. StackOverflowException no se puede capturar en .NET. La única mitigación es actualizar a una versión parcheada. Los operadores pueden reducir (pero no eliminar) el riesgo limitando el tamaño del cuerpo de la solicitud HTTP en la capa del proxy inverso o del equilibrador de carga, aunque la carga útil más pequeña que causa el fallo (40 KB) está muy por debajo de la mayoría de los límites predeterminados de tamaño de cuerpo y es altamente compresible (aproximadamente unos pocos cientos de bytes mediante gzip)."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "ChilliCream",
          "product": "graphql-platform",
          "versions": [
            {
              "version": "< 12.22.7",
              "status": "affected"
            },
            {
              "version": ">= 13.0.0, < 13.9.16",
              "status": "affected"
            },
            {
              "version": ">= 14.0.0, < 14.3.1",
              "status": "affected"
            },
            {
              "version": ">= 15.0.0, < 15.1.14",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-20T16:14:16.099717Z",
          "id": "CVE-2026-40324",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-674"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/ChilliCream/graphql-platform/commit/08c0caa42ca33c121bbed49d2db892e5bf6fb541",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/ChilliCream/graphql-platform/commit/4cbaf67d366f800fc1e484bc5c06dfcf27b45023",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/ChilliCream/graphql-platform/commit/b185eb276c9ee227bd44616ff113be7f01a66c69",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/ChilliCream/graphql-platform/commit/b9271e6a500484c002fd528dcd34d1a9b445480f",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/ChilliCream/graphql-platform/pull/9528",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/ChilliCream/graphql-platform/pull/9530",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/ChilliCream/graphql-platform/pull/9531",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/ChilliCream/graphql-platform/releases/tag/12.22.7",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/ChilliCream/graphql-platform/releases/tag/13.9.16",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/ChilliCream/graphql-platform/releases/tag/14.3.1",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/ChilliCream/graphql-platform/releases/tag/15.1.14",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/ChilliCream/graphql-platform/security/advisories/GHSA-qr3m-xw4c-jqw3",
      "source": "[email protected]"
    }
  ]
}