CVE-2026-73057 | BDVDB-2026-360384 Detail

Description#

stoatchat before 0.15.0 fails to validate SVG viewBox dimensions in the proxy endpoint, allowing attackers to cause denial of service by memory exhaustion. Attackers can host malicious SVGs with extremely large width and height values and trigger concurrent requests to exhaust available memory across proxy replicas.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-08-16Record published in the CVE List.
2. Version 22026-08-18Most recent update recorded in the CVE List.