Denial of Service Vulnerability in Stoatchat by Stoat Technologies
CVE-2026-73057

8.7HIGH

Key Information:

Vendor

Stoatchat

Status
Stoatchat
Vendor
CVE Published:
16 August 2026

What is CVE-2026-73057?

The Stoatchat application prior to version 0.15.0 exhibits a vulnerability due to improper validation of SVG viewBox dimensions in its proxy endpoint. This flaw allows remote attackers to craft malicious SVG files that specify unusually large width and height values. By initiating multiple concurrent requests with these crafted SVGs, an attacker can exploit this weakness to deplete server memory resources, leading to a Denial of Service. This vulnerability poses a significant risk, especially in environments where multiple proxy replicas are utilized.

Affected Version(s)

stoatchat 0 < 0.15.0

stoatchat 0.15.0

References

https://github.com/stoatchat/stoatchat/security/advisorie...
vendor-advisory
https://www.vulncheck.com/advisories/stoatchat-before-unc...
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.