Hot Chocolate's Utf8GraphQLParser has Stack Overflow via Deeply Nested GraphQL Documents

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-40324 · Microsoft / collected KEV context

EUVD-2026-23579

GHSA-qr3m-xw4c-jqw3

cve-program · CVE-2026-40324

• https://github.com/ChilliCream/graphql-platform/security/advisories/GHSA-qr3m-xw4c-jqw3
• https://github.com/ChilliCream/graphql-platform/pull/9528
• https://github.com/ChilliCream/graphql-platform/pull/9530
• https://github.com/ChilliCream/graphql-platform/pull/9531
• https://github.com/ChilliCream/graphql-platform/commit/08c0caa42ca33c121bbed49d2db892e5bf6fb541
• https://github.com/ChilliCream/graphql-platform/commit/4cbaf67d366f800fc1e484bc5c06dfcf27b45023
• https://github.com/ChilliCream/graphql-platform/commit/b185eb276c9ee227bd44616ff113be7f01a66c69
• https://github.com/ChilliCream/graphql-platform/commit/b9271e6a500484c002fd528dcd34d1a9b445480f
• https://github.com/ChilliCream/graphql-platform/releases/tag/12.22.7
• https://github.com/ChilliCream/graphql-platform/releases/tag/13.9.16
• https://github.com/ChilliCream/graphql-platform/releases/tag/14.3.1
• https://github.com/ChilliCream/graphql-platform/releases/tag/15.1.14

euvd · EUVD-2026-23579

• https://github.com/ChilliCream/graphql-platform/security/advisories/GHSA-qr3m-xw4c-jqw3
• https://github.com/ChilliCream/graphql-platform/pull/9528
• https://github.com/ChilliCream/graphql-platform/pull/9530
• https://github.com/ChilliCream/graphql-platform/pull/9531
• https://github.com/ChilliCream/graphql-platform/commit/08c0caa42ca33c121bbed49d2db892e5bf6fb541
• https://github.com/ChilliCream/graphql-platform/commit/4cbaf67d366f800fc1e484bc5c06dfcf27b45023
• https://github.com/ChilliCream/graphql-platform/commit/b185eb276c9ee227bd44616ff113be7f01a66c69
• https://github.com/ChilliCream/graphql-platform/commit/b9271e6a500484c002fd528dcd34d1a9b445480f
• https://github.com/ChilliCream/graphql-platform/releases/tag/12.22.7
• https://github.com/ChilliCream/graphql-platform/releases/tag/13.9.16
• https://github.com/ChilliCream/graphql-platform/releases/tag/14.3.1
• https://github.com/ChilliCream/graphql-platform/releases/tag/15.1.14

nvd · CVE-2026-40324

• https://github.com/ChilliCream/graphql-platform/commit/08c0caa42ca33c121bbed49d2db892e5bf6fb541
• https://github.com/ChilliCream/graphql-platform/commit/4cbaf67d366f800fc1e484bc5c06dfcf27b45023
• https://github.com/ChilliCream/graphql-platform/commit/b185eb276c9ee227bd44616ff113be7f01a66c69
• https://github.com/ChilliCream/graphql-platform/commit/b9271e6a500484c002fd528dcd34d1a9b445480f
• https://github.com/ChilliCream/graphql-platform/pull/9528
• https://github.com/ChilliCream/graphql-platform/pull/9530
• https://github.com/ChilliCream/graphql-platform/pull/9531
• https://github.com/ChilliCream/graphql-platform/releases/tag/12.22.7
• https://github.com/ChilliCream/graphql-platform/releases/tag/13.9.16
• https://github.com/ChilliCream/graphql-platform/releases/tag/14.3.1
• https://github.com/ChilliCream/graphql-platform/releases/tag/15.1.14
• https://github.com/ChilliCream/graphql-platform/security/advisories/GHSA-qr3m-xw4c-jqw3

osv · GHSA-qr3m-xw4c-jqw3

• https://github.com/ChilliCream/graphql-platform/security/advisories/GHSA-qr3m-xw4c-jqw3
• https://nvd.nist.gov/vuln/detail/CVE-2026-40324
• https://github.com/ChilliCream/graphql-platform/pull/9528
• https://github.com/ChilliCream/graphql-platform/pull/9530
• https://github.com/ChilliCream/graphql-platform/pull/9531
• https://github.com/ChilliCream/graphql-platform/commit/08c0caa42ca33c121bbed49d2db892e5bf6fb541
• https://github.com/ChilliCream/graphql-platform/commit/4cbaf67d366f800fc1e484bc5c06dfcf27b45023
• https://github.com/ChilliCream/graphql-platform/commit/b185eb276c9ee227bd44616ff113be7f01a66c69
• https://github.com/ChilliCream/graphql-platform/commit/b9271e6a500484c002fd528dcd34d1a9b445480f
• https://github.com/ChilliCream/graphql-platform
• https://github.com/ChilliCream/graphql-platform/releases/tag/12.22.7
• https://github.com/ChilliCream/graphql-platform/releases/tag/13.9.16
• https://github.com/ChilliCream/graphql-platform/releases/tag/14.3.1
• https://github.com/ChilliCream/graphql-platform/releases/tag/15.1.14

No related operational record is retained in the current change model.