CVE-2026-85664

HighCVSS 7.5

Published: 04/09/2026(UTC)Updated: 10/09/2026(UTC)Translated: 04/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.37%

30th percentile - higher than 30% of all known CVEs

Summary

Chroma 1.5.9 fails to validate maximum bounds on HNSW index parameters max_neighbors, ef_construction, and ef_search in collection-create requests. Unauthenticated attackers can supply arbitrarily large parameter values to exhaust server memory and cause denial of service during index compaction.

Risk Assessment

The risk includes exhaustion of server resources and service disruption, which can lead to system unavailability.

Recommendation

Implement validation of maximum values for HNSW parameters in collection-create requests and restrict access to unauthenticated requests.

Other vulnerabilities in Chroma

CVE-2026-92782High
Chroma through 1.5.9 fails to validate tenant and database segments when resolving collections, allowing authenticated attackers to access collections from other tenants by knowing the collection identifier. Attackers can read, modify, and update records in foreign collections by issuing requests under their own tenant path, bypassing authorization checks.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS