CVE-2026-73057

HIGH

CVE: CVE-2026-73057 - stoatchat before 0Sign in to save

CVSS

7.5

CVSS v3.1

EPSS

N/A

Exploit Prediction Score

Published

August 16, 2026

Exploitability

No EPSS data available

Description

stoatchat before 0.15.0 fails to validate SVG viewBox dimensions in the proxy endpoint, allowing attackers to cause denial of service by memory exhaustion. Attackers can host malicious SVGs with extremely large width and height values and trigger concurrent requests to exhaust available memory across proxy replicas.

Weaknesses

CWE-400

Affected Packages

No package data available.

Aliases

CVE-2026-73057

Related references

Publisher and database URLs for this record (shown for attribution; reading stays in Bugflare).

https://github.com/stoatchat/stoatchat/security/advisories/GHSA-x87r-h3mq-7mgr
https://www.vulncheck.com/advisories/stoatchat-before-uncapped-svg-rendering-denial-of-service