Critical Hot Chocolate GraphQL Server DoS Vulnerability

The National Vulnerability Database has disclosed CVE-2026-40324, a critical denial-of-service vulnerability affecting Hot Chocolate, an open-source GraphQL server. Prior to versions 12.22.7, 13.9.16, 14.3.1, and 15.1.14, the Utf8GraphQLParser lacks a recursion depth limit. This flaw allows an attacker to craft a deeply nested GraphQL document, triggering an uncatchable StackOverflowException in .NET with payloads as small as 40 KB.

This isn’t just a restart; it’s a full process termination. All active HTTP requests, background tasks, and WebSocket subscriptions on the affected worker are immediately dropped. Crucially, this crash occurs before any validation rules, like MaxExecutionDepth or complexity analyzers, can interdict the malicious payload. The MaxAllowedFields limit also offers no protection, as the crashing payloads contain very few fields. This is a fundamental parser flaw, not a logic bypass.

There is no application-level workaround due to the uncatchable nature of StackOverflowException in .NET. The only viable mitigation is a direct upgrade to a patched version. While limiting HTTP request body size at the reverse proxy can reduce risk, the small payload size (40 KB, highly compressible) means most default limits won’t stop this. Defenders need to prioritize patching.