Description

stoatchat versions before 0.15.5 contain a denial of service vulnerability in the acknowledgement worker that processes mass mention messages. Authenticated users can send five crafted role-mention messages to terminate all acknowledgement workers, disabling push notifications and mention badges deployment-wide until the API process restarts.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-26T14:16:51.440Z",
  "pubdate": "2026-09-26T14:16:51.440Z",
  "executiveSummary": "A Denial of Service (DoS) vulnerability exists in stoatchat versions prior to 0.15.5, stemming from improper handling of mass role-mention messages within the acknowledgement worker process.\nThe vulnerability allows authenticated users to crash the worker process responsible for managing push notifications and mention badges.\nBy submitting five specifically crafted role-mention messages, an attacker can trigger an unhandled exception or resource exhaustion event that results in the termination of all worker processes across the deployment.\nThe primary risk involves a total loss of notification and mention functionality for the entire application, which persists until the API service is manually or automatically restarted.\nThis vulnerability requires authenticated access, but provides a low-barrier vector for disrupting platform communication services without requiring elevated administrative privileges.",
  "technicalDetails": "The vulnerability resides within the acknowledgement worker component of stoatchat, which is responsible for the asynchronous processing of user-directed mention notifications.\nThe root cause is an input validation failure during the parsing of role-mention payloads, specifically when multiple mass-mention triggers are processed in rapid succession by the worker thread.\nWhen a user sends a crafted role-mention message, the acknowledgement worker attempts to parse the payload and map it to the relevant notification dispatch queue.\nThe attack flow begins when an authenticated user submits five maliciously constructed role-mention messages to the platform. These messages are designed to exploit a vulnerability in the message processing logic that occurs during the serialization or lookup phase of the mention metadata.\nUpon receiving the fifth message, the worker process experiences a critical failure—likely due to a resource contention issue, an unhandled null pointer dereference, or an excessive memory allocation request that forces the underlying runtime to terminate the process to maintain system stability.\nBecause the acknowledgement worker architecture relies on a shared process pool or a non-resilient worker management scheme, the crash of one worker often cascades, leading to the termination of all active acknowledgement worker instances.\nOnce the workers are terminated, the application ceases to update mention badges or dispatch push notifications to end-users. The system is left in a state of partial operational failure where the primary API may remain responsive, but the notification subsystem remains dormant.\nExploitation is strictly limited to authenticated users, meaning the threat vector is confined to accounts already registered within the stoatchat environment. There is no requirement for administrative or privileged accounts to trigger the crash, as standard user roles possess sufficient permissions to generate role-mention messages.\nPost-exploitation, the impact is deployment-wide. The service remains in a degraded state until the API process is cycled, effectively forcing a restart of the notification pipeline. This makes the vulnerability highly impactful for platforms where timely communication and notifications are critical for operational continuity."
}