Description

stoatchat before 0.15.0 fails to validate SVG viewBox dimensions in the proxy endpoint, allowing attackers to cause denial of service by memory exhaustion. Attackers can host malicious SVGs with extremely large width and height values and trigger concurrent requests to exhaust available memory across proxy replicas.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-16T14:16:55.230Z",
  "pubdate": "2026-08-16T14:16:55.230Z",
  "executiveSummary": "Stoatchat before version 0.15.0 suffers from a denial of service vulnerability residing in the proxy endpoint, specifically caused by an absence of proper validation for Scalable Vector Graphics (SVG) viewBox dimensions. The vulnerability allows remote attackers to exploit the image rendering or processing pipeline of the application by supplying maliciously crafted SVG files containing excessively large width and height parameters. The primary impact of this flaw is severe memory exhaustion, which can lead to application crashes and degradation of service across targeted proxy replicas. The risk implications are high for environments utilizing the vulnerable proxy endpoint, as service availability can be compromised with minimal attacker effort. Attacker capabilities include the ability to orchestrate concurrent requests targeting the proxy endpoint with these malicious payloads, forcing the underlying infrastructure to allocate disproportionate amounts of memory per request. Exploitation requirements involve the capability to host external malicious SVG assets and initiate HTTP requests against the stoatchat proxy endpoint, effectively degrading system resources without requiring authentication or privileged access based on the provided vulnerability scope.",
  "technicalDetails": "The root cause of this vulnerability lies in the stoatchat proxy endpoint prior to version 0.15.0 failing to implement strict boundary validation, sanitization, or dimensional checks on incoming SVG files before processing them. When the proxy endpoint retrieves and processes a malicious SVG containing extreme width and height values within its viewBox or root attributes, the underlying parsing library or rendering engine attempts to allocate internal data structures, buffers, or rasterization matrices scaled to those dimensions.\nThe vulnerable component is explicitly the proxy endpoint responsible for handling or fetching external SVG resources. Affected versions encompass all stoatchat deployments prior to version 0.15.0. Network exposure is inherent to the proxy endpoint, as it is designed to process and handle external inputs or requests from the network.\nThe step-by-step attack flow proceeds as follows: First, an attacker hosts a specially crafted malicious SVG file on an accessible web server, embedding astronomically large width and height values within the vector graphic's attributes. Second, the attacker initiates a series of concurrent HTTP requests directed at the stoatchat proxy endpoint, instructing it to fetch, process, or proxy the malicious SVG file. Third, upon receiving the requests, the proxy endpoint parses the untrusted SVG content without validating the dimensional limits. Fourth, the application attempts to allocate memory proportional to the declared width and height values, triggering massive memory consumption. Finally, by repeating and scaling these concurrent requests across multiple proxy replicas, the attacker rapidly exhausts the available system memory (RAM), leading to out-of-memory (OOM) crashes, service instability, and a complete denial of service for legitimate users."
}