EUVD-2025-210475
GHSA-6j45-2pq3-r728
Vulnerability Assessment
| Weakness |
CWE
|
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 16, 2026
Denial of service in stoatchat (delta) versions before 20250210-1 (0.8.2) lets a remote unauthenticated attacker exhaust server resources by abusing the 'nearby' message query route. A logic error passes a message limit of zero to the database, which MongoDB interprets as 'no limit', so a single crafted request downloads an entire channel's history; parallelized requests amplify this into resource-exhaustion DoS. No public exploit identified at time of analysis and the flaw is not in CISA KEV, but the upstream fix and a VulnCheck advisory are published.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Stoatchat gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
stoatchat (delta) versions before 20250210-1 (0.8.2) contain a logic error in the query messages route. When fetching messages 'nearby' another message, the database query can be given a message limit of zero, which the database interprets as 'no limit'. A remote unauthenticated attacker can craft nearby message fetch requests to download an entire channel's message history in a single expensive request, and can send many such requests in parallel, resulting in denial of service through resource exhaustion.
Executive ViewAI
stoatchat delta (versions before 0.8.2) has a denial-of-service vulnerability affecting all users. Any unauthenticated attacker can remotely crash the service by abusing a logic error in message queries; no public exploit identified at time of analysis. Immediate patching to version 0.8.2 is required to restore service resilience.
Within 24 hours, verify current stoatchat delta deployment version and confirm patch applicability. Within 7 days, stage stoatchat delta 0.8.2 (release 20250210-1) in a non-production environment, conduct load testing on the message query route, and finalize production rollout plan. Within 30 days, deploy version 0.8.2 to all production instances, monitor server resource utilization during rollout to confirm DoS mitigation, and document post-patch validation results.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Server-side request forgery in stoatchat before 0.13.5 allows remote unauthenticated attackers to coerce the server into
Unauthenticated remote attackers can use the January media proxy/embed service in stoatchat before 0.15.5 to probe the h
Memory exhaustion denial of service in stoatchat before 0.15.0 allows unauthenticated remote attackers to crash the serv
Missing authorization in stoatchat's Subscribe message handler exposes private server membership data to any authenticat
MFA enforcement in Stoatchat before 0.15.5 can be bypassed by an attacker who already holds the victim's password, becau
Server-side request forgery in Stoatchat before 0.14.0 lets unauthenticated, network-accessible attackers reach internal
Webhook token disclosure in stoatchat (the Rust 'delta' backend of the Revolt/stoatchat platform) lets any channel membe
MFA bypass in StoatChat before 0.15.5 allows an authenticated attacker to satisfy the MFA step-up re-authentication chal
Authenticated members of a Stoat Chat deployment can permanently (until restart) disable push notifications and mention
Permission bypass in stoatchat before 0.15.0 allows authenticated users holding only ViewChannel access to read individu
Stoatchat releases prior to 0.15.5 hand unauthenticated remote attackers an account-existence oracle: POST /api/auth/ses
SSRF protection bypass in stoatchat before 0.15.0 exposes loopback-bound services to unauthenticated remote attackers th
Exploit-DB