CVE-2026-73057
Received Received - Intake

SVG ViewBox Memory Exhaustion in StoaChat Proxy

Publication date: 2026-08-16

Last updated on: 2026-08-16

Assigner: VulnCheck

Description
stoatchat before 0.15.0 fails to validate SVG viewBox dimensions in the proxy endpoint, allowing attackers to cause denial of service by memory exhaustion. Attackers can host malicious SVGs with extremely large width and height values and trigger concurrent requests to exhaust available memory across proxy replicas.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-16
Last Modified
2026-08-16
Generated
2026-08-16
AI Q&A
2026-08-16
EPSS Evaluated
N/A
NVD
CVE-2026-73057
EUVD
EUVD-2026-59943

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
stoatchat stoatchat to 0.15.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects stoatchat versions before 0.15.0. It allows attackers to cause denial of service by memory exhaustion through SVG files with extremely large viewBox dimensions. The proxy endpoint fails to validate these dimensions, leading to excessive memory allocation when processing malicious SVGs.

Detection Guidance

Check if your stoatchat version is below 0.15.0 by running: stoatchat --version. Monitor memory usage spikes during SVG processing. Inspect proxy logs for requests with unusually large SVG dimensions.

Impact Analysis

An attacker could exploit this by hosting a malicious SVG with large dimensions and sending concurrent requests to the proxy endpoint. This would exhaust available memory across proxy replicas, causing system instability or crashes. The impact includes service disruption and potential downtime.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling denial of service attacks that disrupt system availability. GDPR requires maintaining service availability, while HIPAA mandates reliable access to protected health information. Memory exhaustion from this flaw may cause service outages, violating availability requirements in both standards.

Mitigation Strategies

Upgrade stoatchat to version 0.15.0 or later immediately. Block or filter SVG uploads with excessive dimensions at the network or application level. Limit concurrent requests to the proxy endpoint.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73057. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart