CVE-2025-71377
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
In stoatchat (delta) versions before 20250210-1 (0.8.2), a logic error exists in the query messages route. When fetching messages 'nearby' another message, the database query can be given a message limit of zero, which the database interprets as 'no limit'. A remote unauthenticated attacker can craft nearby message fetch requests to download an entire channel's message history in a single expensive request, and can send many such requests in parallel, resulting in denial of service through resource exhaustion.
Risk Assessment
The risk is that an unauthenticated attacker can perform a DoS attack by overwhelming the server with expensive database queries, causing service unavailability for legitimate users.
Recommendation
Immediately update stoatchat (delta) to version 20250210-1 (0.8.2) or later, which includes a fix for the logic error.
Other vulnerabilities in stoatchat
See all- CVE-2026-74869High
stoatchat before 0.15.0 contains a missing authorization vulnerability in the Subscribe message handler that allows authenticated attackers to enumerate members and monitor profile updates of private servers without membership. Attackers can subscribe to any server's member-update topic by sending a Subscribe message with an arbitrary server ID, receiving live UserUpdate events including display names, avatars, and status changes for members they should not have access to.
- CVE-2026-63306High
Stoatchat before version 0.13.5 contains an unauthenticated server-side request forgery (SSRF) vulnerability in the /proxy and /embed endpoints that accept arbitrary URLs without DNS resolution filtering or private IP range validation. Attackers can enumerate internal services, fingerprint applications, and reach instance metadata endpoints by supplying malicious URLs or leveraging redirect chains.
- CVE-2026-73059Medium
stoatchat before 0.15.0 contains a permission bypass vulnerability in the message_fetch route that checks only ViewChannel permission instead of requiring ReadMessageHistory. Attackers with ViewChannel access but ReadMessageHistory denied can retrieve individual message content by ID, bypassing the intended history restriction enforced by bulk read routes.
- CVE-2026-73058Medium
stoatchat versions before 0.15.0 fail to block the IPv6 unspecified address (::) in the SSRF blocklist, allowing unauthenticated attackers to bypass protections via the /proxy and /embed endpoints. Attackers can craft requests using IPv6 literal syntax to access services on the loopback interface and retrieve sensitive internal content.
- CVE-2026-73057High
stoatchat before 0.15.0 fails to validate SVG viewBox dimensions in the proxy endpoint, allowing attackers to cause denial of service by memory exhaustion. Attackers can host malicious SVGs with extremely large width and height values and trigger concurrent requests to exhaust available memory across proxy replicas.
- CVE-2026-63088High
An SSRF vulnerability in stoatchat before 0.14.0 allows unauthenticated attackers to bypass DNS-based IP blocklists. The url_is_blacklisted function only inspects the first resolved address, while the HTTP client iterates all cached addresses.
- CVE-2025-71388High
A vulnerability in stoatchat (delta/Revolt) versions from 20241213-1 before 20250210-1 allows users with ViewChannel (read) permission on a channel to fetch that channel's webhooks, including their tokens, due to checking ViewChannel instead of ManageWebhooks in the webhook fetch endpoint.
- CVE-2024-58360Medium
A vulnerability in Stoatchat before version 0.7.8 allows attackers to bypass account creation restrictions such as invite-only mode, email verification, captcha, and shield verification. This enables unlimited account creation with unverified email addresses, increasing the risk of denial-of-service attacks and compromising service integrity.
Original NVD description (English source)
stoatchat (delta) versions before 20250210-1 (0.8.2) contain a logic error in the query messages route. When fetching messages 'nearby' another message, the database query can be given a message limit of zero, which the database interprets as 'no limit'. A remote unauthenticated attacker can craft nearby message fetch requests to download an entire channel's message history in a single expensive request, and can send many such requests in parallel, resulting in denial of service through resource exhaustion.