Why SolarWinds Observability Self-Hosted is not affected by CVE-2026-40324

In 2026, the National Institute of Standards and Technology (NIST) published a security bulletin about NVD - CVE-2026-40324.

CVE-2026-40324 is a denial-of-service vulnerability caused by uncontrolled recursion in the Hot Chocolate GraphQL parser. Affected versions fail to enforce recursion depth limits when parsing GraphQL documents, allowing attackers to send maliciously crafted queries that trigger a StackOverflowException and crash the application process. Successful exploitation can lead to service disruption and loss of availability of affected GraphQL services.

Although SolarWinds Observability Self-Hosted includes a version of Hot Chocolate containing the recursion limits parsing issue, it is not affected by the vulnerability since the GraphQL endpoint is not accessible and the vulnerable code path is not used within the product implementation.