Executive brief
Easy Chat Server is a communication platform used for hosting chat rooms. A security vulnerability in version 3.1 allows a remote user to crash the server or potentially execute unauthorized commands by sending a specially crafted chat message. This could lead to a total service outage for all users or unauthorized access to the system hosting the chat server.
Technical details
A classic buffer overflow (CWE-120) exists in Easy Chat Server 3.1 within the chat room message handling component. The vulnerability is triggered when the server processes a request to the '/body2.ghp' endpoint containing an oversized payload (approximately 40,000 characters) in the 'mtowho' recipient parameter. While the NVD description suggests potential for information disclosure and remote code execution, proof-of-concept research confirms a reliable remote denial of service (DoS) by causing the server process to terminate unexpectedly. An attacker requires network access to the server and, in some configurations, a valid authenticated session cookie to reach the vulnerable code path.
Affected products
- Easy Chat Server Easy Chat Server 3.1
Timeline
- 2026-05-22: disclosed
- 2026-05-22: advisory