Which versions of Stoatchat are affected by CVE-2025-71377?

stoatchat delta (versions before 0.8.2) has a denial-of-service vulnerability affecting all users.. A patch is available.

How to fix or mitigate CVE-2025-71377?

Within 24 hours, verify current stoatchat delta deployment version and confirm patch applicability. Within 7 days, stage stoatchat delta 0.8.2 (release 20250210-1) in a non-production environment, conduct load testing on the message query route, and finalize production rollout plan. Within 30 days, deploy version 0.8.2 to all production instances, monitor server resource utilization during rollout to confirm DoS mitigation, and document post-patch validation results.

Stoatchat CVE-2025-71377

Q: What is the CVSS score of CVE-2025-71377?

CVE-2025-71377 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2025-210475 HIGH

Comparison Using Wrong Factors (CWE-1025)

2026-07-16 VulnCheck

GHSA-6j45-2pq3-r728

Denial Of Service Stoatchat

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 16, 2026 - 13:23 vuln.today

Analysis Generated

Jul 16, 2026 - 13:23 vuln.today

CVE Published

Jul 16, 2026 - 12:19 cve.org

HIGH 8.7

DescriptionCVE.org

stoatchat (delta) versions before 20250210-1 (0.8.2) contain a logic error in the query messages route. When fetching messages 'nearby' another message, the database query can be given a message limit of zero, which the database interprets as 'no limit'. A remote unauthenticated attacker can craft nearby message fetch requests to download an entire channel's message history in a single expensive request, and can send many such requests in parallel, resulting in denial of service through resource exhaustion.

AnalysisAI

Denial of service in stoatchat (delta) versions before 20250210-1 (0.8.2) lets a remote unauthenticated attacker exhaust server resources by abusing the 'nearby' message query route. A logic error passes a message limit of zero to the database, which MongoDB interprets as 'no limit', so a single crafted request downloads an entire channel's history; parallelized requests amplify this into resource-exhaustion DoS. No public exploit identified at time of analysis and the flaw is not in CISA KEV, but the upstream fix and a VulnCheck advisory are published.