CVE-2026-40324: Hotchocolate Utf8graphqlparser Missing Recursion Depth Guardcve-2026-40324-hotchocolate-utf8graphqlparser-missing-recursion-depth-guard
Recursive descent parser entry-point method in Utf8GraphQLParser is missing the IncreaseDepth() / DecreaseDepth() recursion-depth guard. An attacker can submit a GraphQL document with deeply nested selection sets, list values, object values, or list/non-null type references that exhausts the managed stack and raises a StackOverflowException, which is uncatch
