HotChocolate.Language
Contains the Hot Chocolate GraphQL parser and lexer. Also included are syntax visitor and syntax rewriter base classes.
Activity
- Latest release
- 22h ago
- Total releases
- 235
- Cadence
- ~daily
- Last 12 months
- 48
Details
- License
- MIT
- First release
- Jun 25, 2018
| Version | Released | |
|---|---|---|
16.6.0-p.8
pre
|
16.6.0-p.8
pre
Dependencies (4)
|
|
16.6.0-p.7
pre
|
16.6.0-p.7
pre
Dependencies (4)
|
|
16.6.0-p.6
pre
|
16.6.0-p.6
pre
Dependencies (4)
|
|
16.6.0-p.5
pre
|
16.6.0-p.5
pre
Dependencies (4)
|
|
16.6.0-p.3
pre
|
16.6.0-p.3
pre
Dependencies (4)
|
|
16.6.0-p.2
pre
|
16.6.0-p.2
pre
Dependencies (4)
|
|
16.6.0-p.1
pre
|
16.6.0-p.1
pre
Dependencies (4)
|
|
16.5.1
patch
|
16.5.1
patch
Dependencies (4)
|
|
16.5.1-p.2
pre
|
16.5.1-p.2
pre
Dependencies (4)
|
|
16.5.1-p.1
pre
|
16.5.1-p.1
pre
Dependencies (4)
|
|
16.5.0
minor
|
16.5.0
minor
Dependencies (4)
|
|
16.4.0
minor
|
16.4.0
minor
Dependencies (4)
|
|
16.3.0
minor
|
16.3.0
minor
Dependencies (4)
|
|
16.2.3
patch
|
16.2.3
patch
Dependencies (4)
|
|
16.2.2
patch
|
16.2.2
patch
Dependencies (4)
|
|
16.2.1
patch
|
16.2.1
patch
Dependencies (4)
|
|
16.2.0
minor
|
16.2.0
minor
Dependencies (4)
|
|
15.1.17
patch
|
15.1.17
patch
Dependencies (4)
|
|
16.1.4
patch
|
16.1.4
patch
Dependencies (4)
|
|
16.1.3
patch
|
16.1.3
patch
Dependencies (4)
|
|
16.1.2
patch
|
16.1.2
patch
Dependencies (4)
|
|
16.1.1
patch
|
16.1.1
patch
Dependencies (4)
|
|
16.1.0
minor
|
16.1.0
minor
Dependencies (4)
|
|
16.0.13
patch
|
16.0.13
patch
Dependencies (4)
|
|
16.0.11
patch
|
16.0.11
patch
Dependencies (4)
|
|
16.0.10
patch
|
16.0.10
patch
Dependencies (4)
|
|
16.0.9
patch
|
16.0.9
patch
Dependencies (4)
|
|
16.0.8
patch
|
16.0.8
patch
Dependencies (4)
|
|
16.0.7
patch
|
16.0.7
patch
Dependencies (4)
|
|
16.0.6
patch
|
16.0.6
patch
Dependencies (4)
|
|
16.0.5
patch
|
16.0.5
patch
Dependencies (4)
|
|
16.0.4
patch
|
16.0.4
patch
Dependencies (4)
|
|
16.0.3
patch
|
16.0.3
patch
Dependencies (4)
|
|
16.0.2
patch
|
16.0.2
patch
Dependencies (4)
|
|
16.0.1
patch
|
16.0.1
patch
Dependencies (4)
|
|
16.0.0
major
|
16.0.0
major
Dependencies (4)
|
|
15.1.16
patch
|
15.1.16
patch
Dependencies (4)
|
|
15.1.15
patch
|
15.1.15
patch
Dependencies (4)
|
|
12.22.7
patch
|
12.22.7
patch
Dependencies (3)
|
|
13.9.16
patch
|
13.9.16
patch
Dependencies (4)
|
|
14.3.1
patch
|
14.3.1
patch
Dependencies (4)
|
|
15.1.14
patch
|
15.1.14
patch
Dependencies (4)
|
|
15.1.13
patch
1 CVE
CVE-2026-40324
GHSA-qr3m-xw4c-jqw3
Apr 16, 2026
ChilliCream GraphQL Platform: Utf8GraphQLParser Stack Overflow via Deeply Nested GraphQL Documents
9.1
/ 10
Critical
Network
Low
None
None
Unchanged
None
High
High
ImpactHot Chocolate's Because This occurs before any validation rules run — Severity: Critical (9.1) — Patches
The fix adds a WorkaroundsThere is no application-level workaround. Operators can reduce (but not eliminate) risk by limiting HTTP request body size at the reverse proxy or load balancer layer, though the smallest crashing payload (40 KB) is well below most default body size limits and is highly compressible (~few hundred bytes via gzip). References
Affected versions
0.1.0
0.1.1
0.1.2
0.1.3
0.1.4
0.2.0
0.2.1
0.2.2
0.2.3
0.3.0
0.3.0-preview-1
0.3.0-preview-2
+ 237 more Show less
0.3.1
0.3.2
0.4.0
0.4.0-preview-1
0.4.0-preview-2
0.4.0-preview-3
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.4.5-preview-1
0.4.5-preview-2
0.4.5-preview-3
0.4.6
0.5.0
0.5.0-preview-1
0.5.0-preview-2
0.5.0-preview-3
0.5.0-preview-4
0.5.0-preview-5
0.5.0-preview-6
0.5.0-preview-7
0.5.1
0.5.2
0.5.3-preview-1
0.6.0
0.6.0-preview-2
0.6.0-preview-3
0.6.0-preview-4
0.6.0-preview-5
0.6.0-preview-6
0.6.0-preview-7
0.6.0-preview-8
0.6.0-preview-9
0.6.0-rc-1
0.6.1
0.6.10
0.6.11
0.6.2
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.6.8
0.6.9
0.7.0
0.8.0
0.8.1
0.8.2
1.0.0-alpha10
1.0.0-alpha6
1.0.0-alpha7
1.0.0-alpha8
1.0.0-alpha9
1.0.0-preview-0001
1.0.0-preview-0002
1.0.0-preview-0003
1.0.0-preview-0004
1.0.0-preview-0005
1.0.0-preview-0006
1.0.0-preview-0007
1.0.0-preview-0008
1.0.0-preview-0009
1.0.0-preview-0010
1.0.0-preview-0011
1.0.0-preview-0012
1.0.0-preview-0013
1.0.0-preview-0014
1.0.0-preview-0015
1.0.0-preview-0016
1.0.0-preview-0017
1.0.0-preview-0019
1.0.0-preview-0020
1.0.0-preview-0021
1.0.0-preview-0022
1.0.0-preview-0023
1.0.0-preview-0024
10.0.0
10.0.1
10.1.0
10.1.1
10.2.0
10.3.0
10.3.1
10.3.2
10.3.3
10.3.4
10.3.5
10.3.6
10.4.0
10.4.1
10.4.2
10.4.3
10.5.0
10.5.1
10.5.2
10.5.3
10.5.4
10.5.5
11.0.0
11.0.1
11.0.2
11.0.3
11.0.4
11.0.5
11.0.6
11.0.7
11.0.8
11.0.9
11.1.0
11.2.0
11.2.1
11.2.2
11.3.0
11.3.1
11.3.2
11.3.3
11.3.4
11.3.5
11.3.6
11.3.7
11.3.8
12.0.0
12.0.1
12.1.0
12.1.1
12.10.0
12.11.0
12.11.1
12.12.0
12.12.1
12.13.0
12.13.1
12.13.2
12.14.0
12.15.0
12.15.1
12.15.2
12.15.3
12.15.4
12.16.0
12.16.2
12.17.0
12.18.0
12.19.2
12.2.0
12.2.1
12.2.2
12.20.0
12.21.0
12.22.0
12.22.1
12.22.2
12.22.3
12.22.4
12.22.5
12.22.6
12.3.0
12.3.1
12.3.2
12.4.0
12.4.1
12.5.0
12.6.0
12.6.1
12.6.2
12.7.0
12.8.0
12.8.1
12.8.2
12.9.0
9.0.0
9.0.1
9.0.2
9.0.3
9.0.4
13.0.0
13.0.1
13.0.2
13.0.3
13.0.4
13.0.5
13.1.0
13.2.0
13.2.1
13.3.0
13.3.1
13.3.2
13.3.3
13.4.0
13.5.0
13.5.1
13.6.0
13.6.1
13.7.0
13.8.0
13.8.1
13.9.0
13.9.1
13.9.10
13.9.11
13.9.12
13.9.13
13.9.14
13.9.15
13.9.2
13.9.3
13.9.4
13.9.5
13.9.6
13.9.7
13.9.8
13.9.9
14.0.0
14.1.0
14.2.0
14.3.0
15.0.0
15.0.1
15.0.2
15.0.3
15.1.0
15.1.1
15.1.10
15.1.11
15.1.12
15.1.13
15.1.2
15.1.3
15.1.4
15.1.5
15.1.6
15.1.7
15.1.8
15.1.9
Fixed in
12.22.7
13.9.16
14.3.1
15.1.14
References
Updated May 05, 2026 · Source: OSV.dev |
15.1.13
patch
Dependencies (4)
|
|
15.1.12
patch
1 CVE
CVE-2026-40324
GHSA-qr3m-xw4c-jqw3
Apr 16, 2026
ChilliCream GraphQL Platform: Utf8GraphQLParser Stack Overflow via Deeply Nested GraphQL Documents
9.1
/ 10
Critical
Network
Low
None
None
Unchanged
None
High
High
ImpactHot Chocolate's Because This occurs before any validation rules run — Severity: Critical (9.1) — Patches
The fix adds a WorkaroundsThere is no application-level workaround. Operators can reduce (but not eliminate) risk by limiting HTTP request body size at the reverse proxy or load balancer layer, though the smallest crashing payload (40 KB) is well below most default body size limits and is highly compressible (~few hundred bytes via gzip). References
Affected versions
0.1.0
0.1.1
0.1.2
0.1.3
0.1.4
0.2.0
0.2.1
0.2.2
0.2.3
0.3.0
0.3.0-preview-1
0.3.0-preview-2
+ 237 more Show less
0.3.1
0.3.2
0.4.0
0.4.0-preview-1
0.4.0-preview-2
0.4.0-preview-3
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.4.5-preview-1
0.4.5-preview-2
0.4.5-preview-3
0.4.6
0.5.0
0.5.0-preview-1
0.5.0-preview-2
0.5.0-preview-3
0.5.0-preview-4
0.5.0-preview-5
0.5.0-preview-6
0.5.0-preview-7
0.5.1
0.5.2
0.5.3-preview-1
0.6.0
0.6.0-preview-2
0.6.0-preview-3
0.6.0-preview-4
0.6.0-preview-5
0.6.0-preview-6
0.6.0-preview-7
0.6.0-preview-8
0.6.0-preview-9
0.6.0-rc-1
0.6.1
0.6.10
0.6.11
0.6.2
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.6.8
0.6.9
0.7.0
0.8.0
0.8.1
0.8.2
1.0.0-alpha10
1.0.0-alpha6
1.0.0-alpha7
1.0.0-alpha8
1.0.0-alpha9
1.0.0-preview-0001
1.0.0-preview-0002
1.0.0-preview-0003
1.0.0-preview-0004
1.0.0-preview-0005
1.0.0-preview-0006
1.0.0-preview-0007
1.0.0-preview-0008
1.0.0-preview-0009
1.0.0-preview-0010
1.0.0-preview-0011
1.0.0-preview-0012
1.0.0-preview-0013
1.0.0-preview-0014
1.0.0-preview-0015
1.0.0-preview-0016
1.0.0-preview-0017
1.0.0-preview-0019
1.0.0-preview-0020
1.0.0-preview-0021
1.0.0-preview-0022
1.0.0-preview-0023
1.0.0-preview-0024
10.0.0
10.0.1
10.1.0
10.1.1
10.2.0
10.3.0
10.3.1
10.3.2
10.3.3
10.3.4
10.3.5
10.3.6
10.4.0
10.4.1
10.4.2
10.4.3
10.5.0
10.5.1
10.5.2
10.5.3
10.5.4
10.5.5
11.0.0
11.0.1
11.0.2
11.0.3
11.0.4
11.0.5
11.0.6
11.0.7
11.0.8
11.0.9
11.1.0
11.2.0
11.2.1
11.2.2
11.3.0
11.3.1
11.3.2
11.3.3
11.3.4
11.3.5
11.3.6
11.3.7
11.3.8
12.0.0
12.0.1
12.1.0
12.1.1
12.10.0
12.11.0
12.11.1
12.12.0
12.12.1
12.13.0
12.13.1
12.13.2
12.14.0
12.15.0
12.15.1
12.15.2
12.15.3
12.15.4
12.16.0
12.16.2
12.17.0
12.18.0
12.19.2
12.2.0
12.2.1
12.2.2
12.20.0
12.21.0
12.22.0
12.22.1
12.22.2
12.22.3
12.22.4
12.22.5
12.22.6
12.3.0
12.3.1
12.3.2
12.4.0
12.4.1
12.5.0
12.6.0
12.6.1
12.6.2
12.7.0
12.8.0
12.8.1
12.8.2
12.9.0
9.0.0
9.0.1
9.0.2
9.0.3
9.0.4
13.0.0
13.0.1
13.0.2
13.0.3
13.0.4
13.0.5
13.1.0
13.2.0
13.2.1
13.3.0
13.3.1
13.3.2
13.3.3
13.4.0
13.5.0
13.5.1
13.6.0
13.6.1
13.7.0
13.8.0
13.8.1
13.9.0
13.9.1
13.9.10
13.9.11
13.9.12
13.9.13
13.9.14
13.9.15
13.9.2
13.9.3
13.9.4
13.9.5
13.9.6
13.9.7
13.9.8
13.9.9
14.0.0
14.1.0
14.2.0
14.3.0
15.0.0
15.0.1
15.0.2
15.0.3
15.1.0
15.1.1
15.1.10
15.1.11
15.1.12
15.1.13
15.1.2
15.1.3
15.1.4
15.1.5
15.1.6
15.1.7
15.1.8
15.1.9
Fixed in
12.22.7
13.9.16
14.3.1
15.1.14
References
Updated May 05, 2026 · Source: OSV.dev |
15.1.12
patch
Dependencies (4)
|
|
15.1.11
patch
1 CVE
CVE-2026-40324
GHSA-qr3m-xw4c-jqw3
Apr 16, 2026
ChilliCream GraphQL Platform: Utf8GraphQLParser Stack Overflow via Deeply Nested GraphQL Documents
9.1
/ 10
Critical
Network
Low
None
None
Unchanged
None
High
High
ImpactHot Chocolate's Because This occurs before any validation rules run — Severity: Critical (9.1) — Patches
The fix adds a WorkaroundsThere is no application-level workaround. Operators can reduce (but not eliminate) risk by limiting HTTP request body size at the reverse proxy or load balancer layer, though the smallest crashing payload (40 KB) is well below most default body size limits and is highly compressible (~few hundred bytes via gzip). References
Affected versions
0.1.0
0.1.1
0.1.2
0.1.3
0.1.4
0.2.0
0.2.1
0.2.2
0.2.3
0.3.0
0.3.0-preview-1
0.3.0-preview-2
+ 237 more Show less
0.3.1
0.3.2
0.4.0
0.4.0-preview-1
0.4.0-preview-2
0.4.0-preview-3
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.4.5-preview-1
0.4.5-preview-2
0.4.5-preview-3
0.4.6
0.5.0
0.5.0-preview-1
0.5.0-preview-2
0.5.0-preview-3
0.5.0-preview-4
0.5.0-preview-5
0.5.0-preview-6
0.5.0-preview-7
0.5.1
0.5.2
0.5.3-preview-1
0.6.0
0.6.0-preview-2
0.6.0-preview-3
0.6.0-preview-4
0.6.0-preview-5
0.6.0-preview-6
0.6.0-preview-7
0.6.0-preview-8
0.6.0-preview-9
0.6.0-rc-1
0.6.1
0.6.10
0.6.11
0.6.2
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.6.8
0.6.9
0.7.0
0.8.0
0.8.1
0.8.2
1.0.0-alpha10
1.0.0-alpha6
1.0.0-alpha7
1.0.0-alpha8
1.0.0-alpha9
1.0.0-preview-0001
1.0.0-preview-0002
1.0.0-preview-0003
1.0.0-preview-0004
1.0.0-preview-0005
1.0.0-preview-0006
1.0.0-preview-0007
1.0.0-preview-0008
1.0.0-preview-0009
1.0.0-preview-0010
1.0.0-preview-0011
1.0.0-preview-0012
1.0.0-preview-0013
1.0.0-preview-0014
1.0.0-preview-0015
1.0.0-preview-0016
1.0.0-preview-0017
1.0.0-preview-0019
1.0.0-preview-0020
1.0.0-preview-0021
1.0.0-preview-0022
1.0.0-preview-0023
1.0.0-preview-0024
10.0.0
10.0.1
10.1.0
10.1.1
10.2.0
10.3.0
10.3.1
10.3.2
10.3.3
10.3.4
10.3.5
10.3.6
10.4.0
10.4.1
10.4.2
10.4.3
10.5.0
10.5.1
10.5.2
10.5.3
10.5.4
10.5.5
11.0.0
11.0.1
11.0.2
11.0.3
11.0.4
11.0.5
11.0.6
11.0.7
11.0.8
11.0.9
11.1.0
11.2.0
11.2.1
11.2.2
11.3.0
11.3.1
11.3.2
11.3.3
11.3.4
11.3.5
11.3.6
11.3.7
11.3.8
12.0.0
12.0.1
12.1.0
12.1.1
12.10.0
12.11.0
12.11.1
12.12.0
12.12.1
12.13.0
12.13.1
12.13.2
12.14.0
12.15.0
12.15.1
12.15.2
12.15.3
12.15.4
12.16.0
12.16.2
12.17.0
12.18.0
12.19.2
12.2.0
12.2.1
12.2.2
12.20.0
12.21.0
12.22.0
12.22.1
12.22.2
12.22.3
12.22.4
12.22.5
12.22.6
12.3.0
12.3.1
12.3.2
12.4.0
12.4.1
12.5.0
12.6.0
12.6.1
12.6.2
12.7.0
12.8.0
12.8.1
12.8.2
12.9.0
9.0.0
9.0.1
9.0.2
9.0.3
9.0.4
13.0.0
13.0.1
13.0.2
13.0.3
13.0.4
13.0.5
13.1.0
13.2.0
13.2.1
13.3.0
13.3.1
13.3.2
13.3.3
13.4.0
13.5.0
13.5.1
13.6.0
13.6.1
13.7.0
13.8.0
13.8.1
13.9.0
13.9.1
13.9.10
13.9.11
13.9.12
13.9.13
13.9.14
13.9.15
13.9.2
13.9.3
13.9.4
13.9.5
13.9.6
13.9.7
13.9.8
13.9.9
14.0.0
14.1.0
14.2.0
14.3.0
15.0.0
15.0.1
15.0.2
15.0.3
15.1.0
15.1.1
15.1.10
15.1.11
15.1.12
15.1.13
15.1.2
15.1.3
15.1.4
15.1.5
15.1.6
15.1.7
15.1.8
15.1.9
Fixed in
12.22.7
13.9.16
14.3.1
15.1.14
References
Updated May 05, 2026 · Source: OSV.dev |
15.1.11
patch
Dependencies (4)
|
|
13.9.15
patch
1 CVE
CVE-2026-40324
GHSA-qr3m-xw4c-jqw3
Apr 16, 2026
ChilliCream GraphQL Platform: Utf8GraphQLParser Stack Overflow via Deeply Nested GraphQL Documents
9.1
/ 10
Critical
Network
Low
None
None
Unchanged
None
High
High
ImpactHot Chocolate's Because This occurs before any validation rules run — Severity: Critical (9.1) — Patches
The fix adds a WorkaroundsThere is no application-level workaround. Operators can reduce (but not eliminate) risk by limiting HTTP request body size at the reverse proxy or load balancer layer, though the smallest crashing payload (40 KB) is well below most default body size limits and is highly compressible (~few hundred bytes via gzip). References
Affected versions
0.1.0
0.1.1
0.1.2
0.1.3
0.1.4
0.2.0
0.2.1
0.2.2
0.2.3
0.3.0
0.3.0-preview-1
0.3.0-preview-2
+ 237 more Show less
0.3.1
0.3.2
0.4.0
0.4.0-preview-1
0.4.0-preview-2
0.4.0-preview-3
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.4.5-preview-1
0.4.5-preview-2
0.4.5-preview-3
0.4.6
0.5.0
0.5.0-preview-1
0.5.0-preview-2
0.5.0-preview-3
0.5.0-preview-4
0.5.0-preview-5
0.5.0-preview-6
0.5.0-preview-7
0.5.1
0.5.2
0.5.3-preview-1
0.6.0
0.6.0-preview-2
0.6.0-preview-3
0.6.0-preview-4
0.6.0-preview-5
0.6.0-preview-6
0.6.0-preview-7
0.6.0-preview-8
0.6.0-preview-9
0.6.0-rc-1
0.6.1
0.6.10
0.6.11
0.6.2
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.6.8
0.6.9
0.7.0
0.8.0
0.8.1
0.8.2
1.0.0-alpha10
1.0.0-alpha6
1.0.0-alpha7
1.0.0-alpha8
1.0.0-alpha9
1.0.0-preview-0001
1.0.0-preview-0002
1.0.0-preview-0003
1.0.0-preview-0004
1.0.0-preview-0005
1.0.0-preview-0006
1.0.0-preview-0007
1.0.0-preview-0008
1.0.0-preview-0009
1.0.0-preview-0010
1.0.0-preview-0011
1.0.0-preview-0012
1.0.0-preview-0013
1.0.0-preview-0014
1.0.0-preview-0015
1.0.0-preview-0016
1.0.0-preview-0017
1.0.0-preview-0019
1.0.0-preview-0020
1.0.0-preview-0021
1.0.0-preview-0022
1.0.0-preview-0023
1.0.0-preview-0024
10.0.0
10.0.1
10.1.0
10.1.1
10.2.0
10.3.0
10.3.1
10.3.2
10.3.3
10.3.4
10.3.5
10.3.6
10.4.0
10.4.1
10.4.2
10.4.3
10.5.0
10.5.1
10.5.2
10.5.3
10.5.4
10.5.5
11.0.0
11.0.1
11.0.2
11.0.3
11.0.4
11.0.5
11.0.6
11.0.7
11.0.8
11.0.9
11.1.0
11.2.0
11.2.1
11.2.2
11.3.0
11.3.1
11.3.2
11.3.3
11.3.4
11.3.5
11.3.6
11.3.7
11.3.8
12.0.0
12.0.1
12.1.0
12.1.1
12.10.0
12.11.0
12.11.1
12.12.0
12.12.1
12.13.0
12.13.1
12.13.2
12.14.0
12.15.0
12.15.1
12.15.2
12.15.3
12.15.4
12.16.0
12.16.2
12.17.0
12.18.0
12.19.2
12.2.0
12.2.1
12.2.2
12.20.0
12.21.0
12.22.0
12.22.1
12.22.2
12.22.3
12.22.4
12.22.5
12.22.6
12.3.0
12.3.1
12.3.2
12.4.0
12.4.1
12.5.0
12.6.0
12.6.1
12.6.2
12.7.0
12.8.0
12.8.1
12.8.2
12.9.0
9.0.0
9.0.1
9.0.2
9.0.3
9.0.4
13.0.0
13.0.1
13.0.2
13.0.3
13.0.4
13.0.5
13.1.0
13.2.0
13.2.1
13.3.0
13.3.1
13.3.2
13.3.3
13.4.0
13.5.0
13.5.1
13.6.0
13.6.1
13.7.0
13.8.0
13.8.1
13.9.0
13.9.1
13.9.10
13.9.11
13.9.12
13.9.13
13.9.14
13.9.15
13.9.2
13.9.3
13.9.4
13.9.5
13.9.6
13.9.7
13.9.8
13.9.9
14.0.0
14.1.0
14.2.0
14.3.0
15.0.0
15.0.1
15.0.2
15.0.3
15.1.0
15.1.1
15.1.10
15.1.11
15.1.12
15.1.13
15.1.2
15.1.3
15.1.4
15.1.5
15.1.6
15.1.7
15.1.8
15.1.9
Fixed in
12.22.7
13.9.16
14.3.1
15.1.14
References
Updated May 05, 2026 · Source: OSV.dev |
13.9.15
patch
Dependencies (4)
|
|
15.1.10
patch
1 CVE
CVE-2026-40324
GHSA-qr3m-xw4c-jqw3
Apr 16, 2026
ChilliCream GraphQL Platform: Utf8GraphQLParser Stack Overflow via Deeply Nested GraphQL Documents
9.1
/ 10
Critical
Network
Low
None
None
Unchanged
None
High
High
ImpactHot Chocolate's Because This occurs before any validation rules run — Severity: Critical (9.1) — Patches
The fix adds a WorkaroundsThere is no application-level workaround. Operators can reduce (but not eliminate) risk by limiting HTTP request body size at the reverse proxy or load balancer layer, though the smallest crashing payload (40 KB) is well below most default body size limits and is highly compressible (~few hundred bytes via gzip). References
Affected versions
0.1.0
0.1.1
0.1.2
0.1.3
0.1.4
0.2.0
0.2.1
0.2.2
0.2.3
0.3.0
0.3.0-preview-1
0.3.0-preview-2
+ 237 more Show less
0.3.1
0.3.2
0.4.0
0.4.0-preview-1
0.4.0-preview-2
0.4.0-preview-3
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.4.5-preview-1
0.4.5-preview-2
0.4.5-preview-3
0.4.6
0.5.0
0.5.0-preview-1
0.5.0-preview-2
0.5.0-preview-3
0.5.0-preview-4
0.5.0-preview-5
0.5.0-preview-6
0.5.0-preview-7
0.5.1
0.5.2
0.5.3-preview-1
0.6.0
0.6.0-preview-2
0.6.0-preview-3
0.6.0-preview-4
0.6.0-preview-5
0.6.0-preview-6
0.6.0-preview-7
0.6.0-preview-8
0.6.0-preview-9
0.6.0-rc-1
0.6.1
0.6.10
0.6.11
0.6.2
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.6.8
0.6.9
0.7.0
0.8.0
0.8.1
0.8.2
1.0.0-alpha10
1.0.0-alpha6
1.0.0-alpha7
1.0.0-alpha8
1.0.0-alpha9
1.0.0-preview-0001
1.0.0-preview-0002
1.0.0-preview-0003
1.0.0-preview-0004
1.0.0-preview-0005
1.0.0-preview-0006
1.0.0-preview-0007
1.0.0-preview-0008
1.0.0-preview-0009
1.0.0-preview-0010
1.0.0-preview-0011
1.0.0-preview-0012
1.0.0-preview-0013
1.0.0-preview-0014
1.0.0-preview-0015
1.0.0-preview-0016
1.0.0-preview-0017
1.0.0-preview-0019
1.0.0-preview-0020
1.0.0-preview-0021
1.0.0-preview-0022
1.0.0-preview-0023
1.0.0-preview-0024
10.0.0
10.0.1
10.1.0
10.1.1
10.2.0
10.3.0
10.3.1
10.3.2
10.3.3
10.3.4
10.3.5
10.3.6
10.4.0
10.4.1
10.4.2
10.4.3
10.5.0
10.5.1
10.5.2
10.5.3
10.5.4
10.5.5
11.0.0
11.0.1
11.0.2
11.0.3
11.0.4
11.0.5
11.0.6
11.0.7
11.0.8
11.0.9
11.1.0
11.2.0
11.2.1
11.2.2
11.3.0
11.3.1
11.3.2
11.3.3
11.3.4
11.3.5
11.3.6
11.3.7
11.3.8
12.0.0
12.0.1
12.1.0
12.1.1
12.10.0
12.11.0
12.11.1
12.12.0
12.12.1
12.13.0
12.13.1
12.13.2
12.14.0
12.15.0
12.15.1
12.15.2
12.15.3
12.15.4
12.16.0
12.16.2
12.17.0
12.18.0
12.19.2
12.2.0
12.2.1
12.2.2
12.20.0
12.21.0
12.22.0
12.22.1
12.22.2
12.22.3
12.22.4
12.22.5
12.22.6
12.3.0
12.3.1
12.3.2
12.4.0
12.4.1
12.5.0
12.6.0
12.6.1
12.6.2
12.7.0
12.8.0
12.8.1
12.8.2
12.9.0
9.0.0
9.0.1
9.0.2
9.0.3
9.0.4
13.0.0
13.0.1
13.0.2
13.0.3
13.0.4
13.0.5
13.1.0
13.2.0
13.2.1
13.3.0
13.3.1
13.3.2
13.3.3
13.4.0
13.5.0
13.5.1
13.6.0
13.6.1
13.7.0
13.8.0
13.8.1
13.9.0
13.9.1
13.9.10
13.9.11
13.9.12
13.9.13
13.9.14
13.9.15
13.9.2
13.9.3
13.9.4
13.9.5
13.9.6
13.9.7
13.9.8
13.9.9
14.0.0
14.1.0
14.2.0
14.3.0
15.0.0
15.0.1
15.0.2
15.0.3
15.1.0
15.1.1
15.1.10
15.1.11
15.1.12
15.1.13
15.1.2
15.1.3
15.1.4
15.1.5
15.1.6
15.1.7
15.1.8
15.1.9
Fixed in
12.22.7
13.9.16
14.3.1
15.1.14
References
Updated May 05, 2026 · Source: OSV.dev |
15.1.10
patch
Dependencies (4)
|
|
15.1.9
patch
1 CVE
CVE-2026-40324
GHSA-qr3m-xw4c-jqw3
Apr 16, 2026
ChilliCream GraphQL Platform: Utf8GraphQLParser Stack Overflow via Deeply Nested GraphQL Documents
9.1
/ 10
Critical
Network
Low
None
None
Unchanged
None
High
High
ImpactHot Chocolate's Because This occurs before any validation rules run — Severity: Critical (9.1) — Patches
The fix adds a WorkaroundsThere is no application-level workaround. Operators can reduce (but not eliminate) risk by limiting HTTP request body size at the reverse proxy or load balancer layer, though the smallest crashing payload (40 KB) is well below most default body size limits and is highly compressible (~few hundred bytes via gzip). References
Affected versions
0.1.0
0.1.1
0.1.2
0.1.3
0.1.4
0.2.0
0.2.1
0.2.2
0.2.3
0.3.0
0.3.0-preview-1
0.3.0-preview-2
+ 237 more Show less
0.3.1
0.3.2
0.4.0
0.4.0-preview-1
0.4.0-preview-2
0.4.0-preview-3
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.4.5-preview-1
0.4.5-preview-2
0.4.5-preview-3
0.4.6
0.5.0
0.5.0-preview-1
0.5.0-preview-2
0.5.0-preview-3
0.5.0-preview-4
0.5.0-preview-5
0.5.0-preview-6
0.5.0-preview-7
0.5.1
0.5.2
0.5.3-preview-1
0.6.0
0.6.0-preview-2
0.6.0-preview-3
0.6.0-preview-4
0.6.0-preview-5
0.6.0-preview-6
0.6.0-preview-7
0.6.0-preview-8
0.6.0-preview-9
0.6.0-rc-1
0.6.1
0.6.10
0.6.11
0.6.2
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.6.8
0.6.9
0.7.0
0.8.0
0.8.1
0.8.2
1.0.0-alpha10
1.0.0-alpha6
1.0.0-alpha7
1.0.0-alpha8
1.0.0-alpha9
1.0.0-preview-0001
1.0.0-preview-0002
1.0.0-preview-0003
1.0.0-preview-0004
1.0.0-preview-0005
1.0.0-preview-0006
1.0.0-preview-0007
1.0.0-preview-0008
1.0.0-preview-0009
1.0.0-preview-0010
1.0.0-preview-0011
1.0.0-preview-0012
1.0.0-preview-0013
1.0.0-preview-0014
1.0.0-preview-0015
1.0.0-preview-0016
1.0.0-preview-0017
1.0.0-preview-0019
1.0.0-preview-0020
1.0.0-preview-0021
1.0.0-preview-0022
1.0.0-preview-0023
1.0.0-preview-0024
10.0.0
10.0.1
10.1.0
10.1.1
10.2.0
10.3.0
10.3.1
10.3.2
10.3.3
10.3.4
10.3.5
10.3.6
10.4.0
10.4.1
10.4.2
10.4.3
10.5.0
10.5.1
10.5.2
10.5.3
10.5.4
10.5.5
11.0.0
11.0.1
11.0.2
11.0.3
11.0.4
11.0.5
11.0.6
11.0.7
11.0.8
11.0.9
11.1.0
11.2.0
11.2.1
11.2.2
11.3.0
11.3.1
11.3.2
11.3.3
11.3.4
11.3.5
11.3.6
11.3.7
11.3.8
12.0.0
12.0.1
12.1.0
12.1.1
12.10.0
12.11.0
12.11.1
12.12.0
12.12.1
12.13.0
12.13.1
12.13.2
12.14.0
12.15.0
12.15.1
12.15.2
12.15.3
12.15.4
12.16.0
12.16.2
12.17.0
12.18.0
12.19.2
12.2.0
12.2.1
12.2.2
12.20.0
12.21.0
12.22.0
12.22.1
12.22.2
12.22.3
12.22.4
12.22.5
12.22.6
12.3.0
12.3.1
12.3.2
12.4.0
12.4.1
12.5.0
12.6.0
12.6.1
12.6.2
12.7.0
12.8.0
12.8.1
12.8.2
12.9.0
9.0.0
9.0.1
9.0.2
9.0.3
9.0.4
13.0.0
13.0.1
13.0.2
13.0.3
13.0.4
13.0.5
13.1.0
13.2.0
13.2.1
13.3.0
13.3.1
13.3.2
13.3.3
13.4.0
13.5.0
13.5.1
13.6.0
13.6.1
13.7.0
13.8.0
13.8.1
13.9.0
13.9.1
13.9.10
13.9.11
13.9.12
13.9.13
13.9.14
13.9.15
13.9.2
13.9.3
13.9.4
13.9.5
13.9.6
13.9.7
13.9.8
13.9.9
14.0.0
14.1.0
14.2.0
14.3.0
15.0.0
15.0.1
15.0.2
15.0.3
15.1.0
15.1.1
15.1.10
15.1.11
15.1.12
15.1.13
15.1.2
15.1.3
15.1.4
15.1.5
15.1.6
15.1.7
15.1.8
15.1.9
Fixed in
12.22.7
13.9.16
14.3.1
15.1.14
References
Updated May 05, 2026 · Source: OSV.dev |
15.1.9
patch
Dependencies (4)
|
|
15.1.8
patch
1 CVE
CVE-2026-40324
GHSA-qr3m-xw4c-jqw3
Apr 16, 2026
ChilliCream GraphQL Platform: Utf8GraphQLParser Stack Overflow via Deeply Nested GraphQL Documents
9.1
/ 10
Critical
Network
Low
None
None
Unchanged
None
High
High
ImpactHot Chocolate's Because This occurs before any validation rules run — Severity: Critical (9.1) — Patches
The fix adds a WorkaroundsThere is no application-level workaround. Operators can reduce (but not eliminate) risk by limiting HTTP request body size at the reverse proxy or load balancer layer, though the smallest crashing payload (40 KB) is well below most default body size limits and is highly compressible (~few hundred bytes via gzip). References
Affected versions
0.1.0
0.1.1
0.1.2
0.1.3
0.1.4
0.2.0
0.2.1
0.2.2
0.2.3
0.3.0
0.3.0-preview-1
0.3.0-preview-2
+ 237 more Show less
0.3.1
0.3.2
0.4.0
0.4.0-preview-1
0.4.0-preview-2
0.4.0-preview-3
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.4.5-preview-1
0.4.5-preview-2
0.4.5-preview-3
0.4.6
0.5.0
0.5.0-preview-1
0.5.0-preview-2
0.5.0-preview-3
0.5.0-preview-4
0.5.0-preview-5
0.5.0-preview-6
0.5.0-preview-7
0.5.1
0.5.2
0.5.3-preview-1
0.6.0
0.6.0-preview-2
0.6.0-preview-3
0.6.0-preview-4
0.6.0-preview-5
0.6.0-preview-6
0.6.0-preview-7
0.6.0-preview-8
0.6.0-preview-9
0.6.0-rc-1
0.6.1
0.6.10
0.6.11
0.6.2
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.6.8
0.6.9
0.7.0
0.8.0
0.8.1
0.8.2
1.0.0-alpha10
1.0.0-alpha6
1.0.0-alpha7
1.0.0-alpha8
1.0.0-alpha9
1.0.0-preview-0001
1.0.0-preview-0002
1.0.0-preview-0003
1.0.0-preview-0004
1.0.0-preview-0005
1.0.0-preview-0006
1.0.0-preview-0007
1.0.0-preview-0008
1.0.0-preview-0009
1.0.0-preview-0010
1.0.0-preview-0011
1.0.0-preview-0012
1.0.0-preview-0013
1.0.0-preview-0014
1.0.0-preview-0015
1.0.0-preview-0016
1.0.0-preview-0017
1.0.0-preview-0019
1.0.0-preview-0020
1.0.0-preview-0021
1.0.0-preview-0022
1.0.0-preview-0023
1.0.0-preview-0024
10.0.0
10.0.1
10.1.0
10.1.1
10.2.0
10.3.0
10.3.1
10.3.2
10.3.3
10.3.4
10.3.5
10.3.6
10.4.0
10.4.1
10.4.2
10.4.3
10.5.0
10.5.1
10.5.2
10.5.3
10.5.4
10.5.5
11.0.0
11.0.1
11.0.2
11.0.3
11.0.4
11.0.5
11.0.6
11.0.7
11.0.8
11.0.9
11.1.0
11.2.0
11.2.1
11.2.2
11.3.0
11.3.1
11.3.2
11.3.3
11.3.4
11.3.5
11.3.6
11.3.7
11.3.8
12.0.0
12.0.1
12.1.0
12.1.1
12.10.0
12.11.0
12.11.1
12.12.0
12.12.1
12.13.0
12.13.1
12.13.2
12.14.0
12.15.0
12.15.1
12.15.2
12.15.3
12.15.4
12.16.0
12.16.2
12.17.0
12.18.0
12.19.2
12.2.0
12.2.1
12.2.2
12.20.0
12.21.0
12.22.0
12.22.1
12.22.2
12.22.3
12.22.4
12.22.5
12.22.6
12.3.0
12.3.1
12.3.2
12.4.0
12.4.1
12.5.0
12.6.0
12.6.1
12.6.2
12.7.0
12.8.0
12.8.1
12.8.2
12.9.0
9.0.0
9.0.1
9.0.2
9.0.3
9.0.4
13.0.0
13.0.1
13.0.2
13.0.3
13.0.4
13.0.5
13.1.0
13.2.0
13.2.1
13.3.0
13.3.1
13.3.2
13.3.3
13.4.0
13.5.0
13.5.1
13.6.0
13.6.1
13.7.0
13.8.0
13.8.1
13.9.0
13.9.1
13.9.10
13.9.11
13.9.12
13.9.13
13.9.14
13.9.15
13.9.2
13.9.3
13.9.4
13.9.5
13.9.6
13.9.7
13.9.8
13.9.9
14.0.0
14.1.0
14.2.0
14.3.0
15.0.0
15.0.1
15.0.2
15.0.3
15.1.0
15.1.1
15.1.10
15.1.11
15.1.12
15.1.13
15.1.2
15.1.3
15.1.4
15.1.5
15.1.6
15.1.7
15.1.8
15.1.9
Fixed in
12.22.7
13.9.16
14.3.1
15.1.14
References
Updated May 05, 2026 · Source: OSV.dev |
15.1.8
patch
Dependencies (4)
|
|
15.1.7
patch
1 CVE
CVE-2026-40324
GHSA-qr3m-xw4c-jqw3
Apr 16, 2026
ChilliCream GraphQL Platform: Utf8GraphQLParser Stack Overflow via Deeply Nested GraphQL Documents
9.1
/ 10
Critical
Network
Low
None
None
Unchanged
None
High
High
ImpactHot Chocolate's Because This occurs before any validation rules run — Severity: Critical (9.1) — Patches
The fix adds a WorkaroundsThere is no application-level workaround. Operators can reduce (but not eliminate) risk by limiting HTTP request body size at the reverse proxy or load balancer layer, though the smallest crashing payload (40 KB) is well below most default body size limits and is highly compressible (~few hundred bytes via gzip). References
Affected versions
0.1.0
0.1.1
0.1.2
0.1.3
0.1.4
0.2.0
0.2.1
0.2.2
0.2.3
0.3.0
0.3.0-preview-1
0.3.0-preview-2
+ 237 more Show less
0.3.1
0.3.2
0.4.0
0.4.0-preview-1
0.4.0-preview-2
0.4.0-preview-3
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.4.5-preview-1
0.4.5-preview-2
0.4.5-preview-3
0.4.6
0.5.0
0.5.0-preview-1
0.5.0-preview-2
0.5.0-preview-3
0.5.0-preview-4
0.5.0-preview-5
0.5.0-preview-6
0.5.0-preview-7
0.5.1
0.5.2
0.5.3-preview-1
0.6.0
0.6.0-preview-2
0.6.0-preview-3
0.6.0-preview-4
0.6.0-preview-5
0.6.0-preview-6
0.6.0-preview-7
0.6.0-preview-8
0.6.0-preview-9
0.6.0-rc-1
0.6.1
0.6.10
0.6.11
0.6.2
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.6.8
0.6.9
0.7.0
0.8.0
0.8.1
0.8.2
1.0.0-alpha10
1.0.0-alpha6
1.0.0-alpha7
1.0.0-alpha8
1.0.0-alpha9
1.0.0-preview-0001
1.0.0-preview-0002
1.0.0-preview-0003
1.0.0-preview-0004
1.0.0-preview-0005
1.0.0-preview-0006
1.0.0-preview-0007
1.0.0-preview-0008
1.0.0-preview-0009
1.0.0-preview-0010
1.0.0-preview-0011
1.0.0-preview-0012
1.0.0-preview-0013
1.0.0-preview-0014
1.0.0-preview-0015
1.0.0-preview-0016
1.0.0-preview-0017
1.0.0-preview-0019
1.0.0-preview-0020
1.0.0-preview-0021
1.0.0-preview-0022
1.0.0-preview-0023
1.0.0-preview-0024
10.0.0
10.0.1
10.1.0
10.1.1
10.2.0
10.3.0
10.3.1
10.3.2
10.3.3
10.3.4
10.3.5
10.3.6
10.4.0
10.4.1
10.4.2
10.4.3
10.5.0
10.5.1
10.5.2
10.5.3
10.5.4
10.5.5
11.0.0
11.0.1
11.0.2
11.0.3
11.0.4
11.0.5
11.0.6
11.0.7
11.0.8
11.0.9
11.1.0
11.2.0
11.2.1
11.2.2
11.3.0
11.3.1
11.3.2
11.3.3
11.3.4
11.3.5
11.3.6
11.3.7
11.3.8
12.0.0
12.0.1
12.1.0
12.1.1
12.10.0
12.11.0
12.11.1
12.12.0
12.12.1
12.13.0
12.13.1
12.13.2
12.14.0
12.15.0
12.15.1
12.15.2
12.15.3
12.15.4
12.16.0
12.16.2
12.17.0
12.18.0
12.19.2
12.2.0
12.2.1
12.2.2
12.20.0
12.21.0
12.22.0
12.22.1
12.22.2
12.22.3
12.22.4
12.22.5
12.22.6
12.3.0
12.3.1
12.3.2
12.4.0
12.4.1
12.5.0
12.6.0
12.6.1
12.6.2
12.7.0
12.8.0
12.8.1
12.8.2
12.9.0
9.0.0
9.0.1
9.0.2
9.0.3
9.0.4
13.0.0
13.0.1
13.0.2
13.0.3
13.0.4
13.0.5
13.1.0
13.2.0
13.2.1
13.3.0
13.3.1
13.3.2
13.3.3
13.4.0
13.5.0
13.5.1
13.6.0
13.6.1
13.7.0
13.8.0
13.8.1
13.9.0
13.9.1
13.9.10
13.9.11
13.9.12
13.9.13
13.9.14
13.9.15
13.9.2
13.9.3
13.9.4
13.9.5
13.9.6
13.9.7
13.9.8
13.9.9
14.0.0
14.1.0
14.2.0
14.3.0
15.0.0
15.0.1
15.0.2
15.0.3
15.1.0
15.1.1
15.1.10
15.1.11
15.1.12
15.1.13
15.1.2
15.1.3
15.1.4
15.1.5
15.1.6
15.1.7
15.1.8
15.1.9
Fixed in
12.22.7
13.9.16
14.3.1
15.1.14
References
Updated May 05, 2026 · Source: OSV.dev |
15.1.7
patch
Dependencies (4)
|