stoatchat CVE-2026-73057

The stoatchat proxy endpoint must be network-accessible to the attacker, which the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms requires no authentication, no special configuration beyond a default deployment, and no user interaction. The attacker must be able to host or reference an SVG file with extreme dimension values reachable by the stoatchat proxy - this requires control of an externally reachable URL the proxy will fetch. Effective memory exhaustion across replicas further requires the ability to issue concurrent requests simultaneously, meaning a single sequential request is unlikely to alone exhaust memory. Limiting factors: the attacker must control or access an SVG-hosting URL the proxy will resolve; the concurrent-request requirement introduces operational complexity compared to single-packet exploits; and exploitation impact is limited to availability with no confidentiality or integrity consequence.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N) places this firmly as a remotely exploitable, zero-complexity, no-privilege denial-of-service: the highest tier of DoS risk in terms of reachability and ease. No EPSS score was supplied in the input, so exploitation probability cannot be quantified numerically. No CISA KEV listing was provided, meaning confirmed active exploitation is not established at time of analysis. The attack barrier is low - an attacker only needs to host a malicious SVG and script concurrent HTTP requests - but effective exhaustion across replicas does require volumetric concurrency, adding modest operational overhead. The primary limiting factor for real-world impact is stoatchat's niche deployment footprint; internet-facing stoatchat instances with an unauthenticated proxy endpoint represent the highest-risk population. No conflicting signals were identified between CVSS and the description.

An unauthenticated attacker hosts an SVG file on a public server with viewBox dimensions set to near-integer-maximum values (e.g., width='2000000000' height='2000000000'). The attacker then scripts a tool to issue hundreds of simultaneous HTTP requests to the stoatchat proxy endpoint referencing this SVG URL, causing each replica to allocate memory proportional to the declared dimensions per request. As allocations accumulate across replicas without being bounded or released, available system memory is exhausted and the stoatchat service crashes or becomes unresponsive, constituting a complete denial of service.