Hot Chocolate, the GraphQL server library, contains a recursive descent parser with no bound on recursion depth. When an attacker sends a carefully constructed GraphQL document featuring deeply nested selection sets, object values, list values, or list types, the parser can consume an unlimited stack and trigger a StackOverflowException. Because the exception is uncatchable in .NET, the entire worker process terminates, causing all in-flight HTTP requests, background services, and WebSocket subscriptions to fail and requiring the orchestrator to restart the process. The issue is resolved in releases 12.22.7, 13.9.16, 14.3.1, and 15.1.14, which introduce a safe default recursion depth limit and throw a catchable SyntaxException instead of allowing a stack overflow.

Systems built with the ChilliCream Hot Chocolate GraphQL platform running a version earlier than 12.22.7, 13.9.16, 14.3.1, or 15.1.14 are affected. This includes any .NET application that hosts the Hot Chocolate library to process GraphQL requests. The failure occurs within the application process, regardless of hardware environment.

The CVSS score of 9.1 indicates a Critical severity. Although the EPSS score is not available, the vulnerability can be exploited with a payload that can be compressed to only a few hundred bytes, easily bypassing typical body size limits. The stack overflow occurs before any GraphQL validation runs, so standard mitigations such as complexity analysis or persisted query whitelisting do not protect the service. An attacker who can send the crafted query can bring the application down without authentication, presenting a high risk of denial of service in production environments.