CVE-2026-73057: high-severity vulnerability in stoatchat
stoatchat before 0.15.0 Uncapped SVG Rendering Denial of Service
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.7epss 0.3%
stoatchat before 0.15.0 fails to validate SVG viewBox dimensions in the proxy endpoint, allowing attackers to cause denial of service by memory exhaustion. Attackers can host malicious SVGs with extremely large width and height values and trigger concurrent requests to exhaust available memory across proxy replicas.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected products
stoatchat · stoatchatRelated CVEs — stoatchat
In the same product, most dangerous first.
CVE-2025-71377HIGHstoatchat before 20250210-1 Unrestricted Message History FetchEPSS 0.7%CVE-2026-100676HIGHstoatchat before 0.15.5 Local Filesystem Read via SVGEPSS 0.5%CVE-2025-71388HIGHstoatchat 20241213-1 Webhook Token Disclosure via Read PermissionsEPSS 0.5%CVE-2026-63088HIGHstoatchat < 0.14.0 SSRF via DNS-based IP Blocklist BypassEPSS 0.5%CVE-2024-58360MEDIUMstoatchat before 0.7.8 Unrestricted Account CreationEPSS 0.4%CVE-2026-100679HIGHstoatchat before 0.15.5 MFA Bypass via Cross-Account TicketEPSS 0.4%