Vulnerability Description
stoatchat before 0.15.0 fails to validate SVG viewBox dimensions in the proxy endpoint, allowing attackers to cause denial of service by memory exhaustion. Attackers can host malicious SVGs with extremely large width and height values and trigger concurrent requests to exhaust available memory across proxy replicas.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/stoatchat/stoatchat/security/advisories/GHSA-x87r-h3mq-7mgr
- https://www.vulncheck.com/advisories/stoatchat-before-uncapped-svg-rendering-den
- https://github.com/stoatchat/stoatchat/security/advisories/GHSA-x87r-h3mq-7mgr
FAQ
What is CVE-2026-73057?
CVE-2026-73057 is a vulnerability with a CVSS score of 7.5 (HIGH). stoatchat before 0.15.0 fails to validate SVG viewBox dimensions in the proxy endpoint, allowing attackers to cause denial of service by memory exhaustion. Attackers can host malicious SVGs with extre...
How severe is CVE-2026-73057?
CVE-2026-73057 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-73057?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.