EUVD-2026-59943
GHSA-4rgf-ww29-jxx4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible proxy requires no authentication or interaction; impact is availability-only with no scope change, confidentiality, or integrity effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
stoatchat before 0.15.0 fails to validate SVG viewBox dimensions in the proxy endpoint, allowing attackers to cause denial of service by memory exhaustion. Attackers can host malicious SVGs with extremely large width and height values and trigger concurrent requests to exhaust available memory across proxy replicas.
AnalysisAI
Memory exhaustion denial of service in stoatchat before 0.15.0 allows unauthenticated remote attackers to crash the service by submitting concurrent proxy requests referencing attacker-hosted SVGs with arbitrarily large viewBox width and height values. The proxy endpoint allocates memory proportional to declared SVG dimensions without enforcing any upper bound (CWE-400), and concurrent exploitation amplifies impact across all running replicas simultaneously. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The stoatchat proxy endpoint must be network-accessible to the attacker, which the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms requires no authentication, no special configuration beyond a default deployment, and no user interaction. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N) places this firmly as a remotely exploitable, zero-complexity, no-privilege denial-of-service: the highest tier of DoS risk in terms of reachability and ease. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker hosts an SVG file on a public server with viewBox dimensions set to near-integer-maximum values (e.g., width='2000000000' height='2000000000'). The attacker then scripts a tool to issue hundreds of simultaneous HTTP requests to the stoatchat proxy endpoint referencing this SVG URL, causing each replica to allocate memory proportional to the declared dimensions per request. … |
| Remediation | Upgrade stoatchat to version 0.15.0 or later, which introduces dimension validation in the SVG proxy endpoint; this is the primary and recommended fix per the GitHub security advisory at https://github.com/stoatchat/stoatchat/security/advisories/GHSA-x87r-h3mq-7mgr. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all stoatchat deployments and identify versions currently in use to determine exposure scope. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Server-side request forgery in stoatchat before 0.13.5 allows remote unauthenticated attackers to coerce the server into
Denial of service in stoatchat (delta) versions before 20250210-1 (0.8.2) lets a remote unauthenticated attacker exhaust
Missing authorization in stoatchat's Subscribe message handler exposes private server membership data to any authenticat
Server-side request forgery in Stoatchat before 0.14.0 lets unauthenticated, network-accessible attackers reach internal
Webhook token disclosure in stoatchat (the Rust 'delta' backend of the Revolt/stoatchat platform) lets any channel membe
Permission bypass in stoatchat before 0.15.0 allows authenticated users holding only ViewChannel access to read individu
SSRF protection bypass in stoatchat before 0.15.0 exposes loopback-bound services to unauthenticated remote attackers th
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today