{"action":"Upgrade HotChocolate.Language to 12.22.7 (12.x), 13.9.16 (13.x), 14.3.1 (14.x) or 15.1.14 (15.x) or later.","affected":[{"fixed":"12.22.7","introduced":"0"},{"fixed":"13.9.16","introduced":"13.0.0"},{"fixed":"14.3.1","introduced":"14.0.0"},{"fixed":"15.1.14","introduced":"15.0.0"}],"component":"HotChocolate.Language","cve_ids":["CVE-2026-40324"],"ecosystem":"NuGet","epss":0.00902,"exploited":false,"fixed_versions":["12.22.7","13.9.16","14.3.1","15.1.14"],"ghsa_id":"GHSA-qr3m-xw4c-jqw3","id":"tcs_01M5N8YXF00DBXMS3J6886BZRC","modified_at":"2026-05-05T16:10:29.864201Z","published_at":"2026-04-16T21:09:40Z","references":["https://osv.dev/vulnerability/GHSA-qr3m-xw4c-jqw3","https://github.com/ChilliCream/graphql-platform/security/advisories/GHSA-qr3m-xw4c-jqw3","https://nvd.nist.gov/vuln/detail/CVE-2026-40324","https://github.com/ChilliCream/graphql-platform/pull/9528","https://github.com/ChilliCream/graphql-platform/pull/9530","https://github.com/ChilliCream/graphql-platform/pull/9531","https://github.com/ChilliCream/graphql-platform/commit/08c0caa42ca33c121bbed49d2db892e5bf6fb541","https://github.com/ChilliCream/graphql-platform/commit/4cbaf67d366f800fc1e484bc5c06dfcf27b45023","https://github.com/ChilliCream/graphql-platform/commit/b185eb276c9ee227bd44616ff113be7f01a66c69","https://github.com/ChilliCream/graphql-platform/commit/b9271e6a500484c002fd528dcd34d1a9b445480f","https://github.com/ChilliCream/graphql-platform","https://github.com/ChilliCream/graphql-platform/releases/tag/12.22.7","https://github.com/ChilliCream/graphql-platform/releases/tag/13.9.16","https://github.com/ChilliCream/graphql-platform/releases/tag/14.3.1","https://github.com/ChilliCream/graphql-platform/releases/tag/15.1.14"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"GHSA-qr3m-xw4c-jqw3","url":"https://osv.dev/vulnerability/GHSA-qr3m-xw4c-jqw3"}],"summary":"ChilliCream GraphQL Platform: Utf8GraphQLParser Stack Overflow via Deeply Nested GraphQL Documents"}