CVE-2026-40324

OVERVIEW CVE-2026-40324 is a stack overflow vulnerability affecting Hot Chocolate, an open-source GraphQL server. The recursive descent parser lacks recursion depth limits, allowing attackers to craft deeply nested GraphQL documents that trigger unrecoverable StackOverflowException errors. Affected versions are those prior to 12.22.7, 13.9.16, 14.3.1, and 15.1.14. Exploitation requires as little as 40 KB of malicious GraphQL input, well within typical network transfer limits. SEVERITY This is a critical denial-of-service vulnerability with a CVSS score of 9.1. The attack vector is network-based with no authentication required, and exploitation complexity is minimal. The impact is severe: uncatchable stack overflow exceptions immediately terminate the entire worker process in the .NET runtime, dropping all in-flight HTTP requests, background tasks, and WebSocket subscriptions. Because StackOverflowException cannot be caught in .NET, all standard validation controls—including MaxExecutionDepth checks, complexity analyzers, and persisted query allow-lists—cannot intercept the crash. Request body size limits offer minimal protection given the small payload size and high compressibility. EXPLOITATION STATUS There is no evidence of active exploitation or publicly available exploit code. The vulnerability has not been assigned to the Known Exploited Vulnerabilities (KEV) catalog, and community attention appears limited based on its low EPSS score of 0.00043. The threat remains theoretical but unmitigated without patching, making immediate upgrade to the fixed versions essential for production deployments.