CVE-2026-85664
Received Received - Intake

Chroma 1.5.9 Memory Exhaustion via HNSW Index Parameters

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: VulnCheck

Description
Chroma 1.5.9 fails to validate maximum bounds on HNSW index parameters max_neighbors, ef_construction, and ef_search in collection-create requests. Unauthenticated attackers can supply arbitrarily large parameter values to exhaust server memory and cause denial of service during index compaction.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-85664
EUVD
EUVD-2026-71120

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
chroma chroma to 1.5.9 (inc)
chroma chroma 1.5.9

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Chroma 1.5.9 fails to validate maximum bounds on HNSW index parameters max_neighbors, ef_construction, and ef_search during collection creation. Unauthenticated attackers can send excessively large values for these parameters, causing the server to exhaust memory and crash during index compaction, leading to a denial-of-service condition.

Detection Guidance

Monitor for unusually high memory usage during index compaction in Chroma 1.5.9. Check logs for collection-create requests with abnormally large max_neighbors, ef_construction, or ef_search values. Use system monitoring tools like top, htop, or ps to observe memory consumption spikes during database operations.

Impact Analysis

This vulnerability allows unauthenticated attackers to disrupt service availability by causing memory exhaustion and crashes. Systems using Chroma 1.5.9 or below may experience downtime, degraded performance, or complete service unavailability during index operations.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling denial-of-service attacks that disrupt availability of systems handling personal or health data. Memory exhaustion from unbounded HNSW parameters may cause service outages, violating availability requirements in GDPR Article 32 and HIPAA Security Rule §164.308(a)(7). Unauthorized access risks from DoS conditions may also affect integrity and confidentiality controls.

Mitigation Strategies

Upgrade Chroma to a patched version beyond 1.5.9. Implement input validation to enforce reasonable bounds on HNSW parameters. Restrict unauthenticated access to collection-create endpoints. Monitor for suspicious requests with large parameter values.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85664. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart