Memory Exhaustion Vulnerability in Chroma by Chroma Core

CVE-2026-85664

What is CVE-2026-85664?

Chroma version 1.5.9 contains a vulnerability that allows unauthenticated attackers to exploit improperly validated HNSW index parameters in collection-create requests. By supplying excessively large values for parameters such as max_neighbors, ef_construction, and ef_search, attackers can exhaust server memory resources, leading to denial of service during critical index compaction processes. The lack of input validation poses a significant risk, allowing for potential disruption of services.

References