CVE-2025-71377highCWE-1025

CVE-2025-71377: falha de alta gravidade em stoatchat

stoatchat before 20250210-1 Unrestricted Message History Fetch

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar stoatchat

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.7epss 0.7%
stoatchat (delta) versions before 20250210-1 (0.8.2) contain a logic error in the query messages route. When fetching messages 'nearby' another message, the database query can be given a message limit of zero, which the database interprets as 'no limit'. A remote unauthenticated attacker can craft nearby message fetch requests to download an entire channel's message history in a single expensive request, and can send many such requests in parallel, resulting in denial of service through resource exhaustion.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Produtos afetados
stoatchat · stoatchat
CVEs relacionadas — stoatchat

No mesmo produto, das mais perigosas para as menos.

CVE-2026-100676HIGHstoatchat before 0.15.5 Local Filesystem Read via SVGEPSS 0.5%CVE-2025-71388HIGHstoatchat 20241213-1 Webhook Token Disclosure via Read PermissionsEPSS 0.5%CVE-2026-63088HIGHstoatchat < 0.14.0 SSRF via DNS-based IP Blocklist BypassEPSS 0.5%CVE-2024-58360MEDIUMstoatchat before 0.7.8 Unrestricted Account CreationEPSS 0.4%CVE-2026-100679HIGHstoatchat before 0.15.5 MFA Bypass via Cross-Account TicketEPSS 0.4%CVE-2026-73059HIGHstoatchat before 0.15.0 Permission Bypass via message_fetchEPSS 0.4%