Executive brief
stoatchat, a messaging platform, contains a flaw in how it handles requests for message history. An attacker can exploit this to force the server to retrieve every single message in a chat channel at once. This can overwhelm the system's resources, leading to a complete service outage for all users.
Technical details
A logic error exists in the 'query messages' route when fetching messages 'nearby' a specific message ID. If the message limit parameter is manipulated or calculated as zero, the underlying MongoDB database interprets this as 'no limit'. A remote, unauthenticated attacker can send crafted requests to fetch an entire channel's message history in a single operation. By executing multiple such expensive queries in parallel, an attacker can exhaust server CPU, memory, and database resources, resulting in a denial of service (DoS). The issue is fixed in version 20250210-1 (0.8.2) by ensuring the limit is always at least 1.
Affected products
- stoatchat stoatchat (delta) < 20250210-1 (0.8.2)
Timeline
- 2025-02-10: patched: Fix committed and version 0.8.2 released
- 2025-02-10: advisory: GitHub Security Advisory published
- 2026-07-16: disclosed: NVD publication date