Executive brief
AIChat is a command-line application that includes an HTTP API server. The API endpoint fails to properly limit memory allocation when processing incoming HTTP request bodies, allowing a remote attacker to send specially crafted requests that exhaust server memory and cause a denial of service, making the application unavailable to legitimate users.
Technical details
The vulnerability is an uncontrolled memory allocation flaw in the API endpoint request body handling code (src/serve.rs). An attacker can exploit this remotely by sending HTTP requests with oversized or malicious request bodies to trigger unbounded memory consumption. No authentication is required to initiate the attack. The vulnerability affects versions up to 0.30.4. The vendor was contacted early but did not respond or provide a patch. The exploit code has been publicly disclosed.
Affected products
- sigoden aichat up to 0.30.4
Timeline
- 2026-09-02: disclosed: CVE-2026-84857 published