CVE-2026-100675

MEDIUMCVSS 6.5

Description

stoatchat versions before 0.15.5 contain a denial of service vulnerability in the acknowledgement worker that processes mass mention messages. Authenticated users can send five crafted role-mention messages to terminate all acknowledgement workers, disabling push notifications and mention badges deployment-wide until the API process restarts.

Timeline

Published:September 26th, 2026 2:16 PM

Last modified:September 28th, 2026 6:17 PM

CVSS Scoring

CVSS v3: 6.5 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-248

References & Reports

Advisories, patches, and third-party reports

https://github.com/stoatchat/stoatchat/security/advisories/GHSA-5gq6-v4cf-3qq8
https://www.vulncheck.com/advisories/stoatchat-before-0.15.5-denial-of-service-via-mass-mentions
https://github.com/stoatchat/stoatchat/security/advisories/GHSA-5gq6-v4cf-3qq8

Source: NIST NVD · Data may lag official sources by up to one minute