CVE-2025-71377
NONE—CVSS v3
—CVSS v2
0.38%
EPSS (exploit probability)
CWE-1025CWE
Description
stoatchat (delta) versions before 20250210-1 (0.8.2) contain a logic error in the query messages route. When fetching messages 'nearby' another message, the database query can be given a message limit of zero, which the database interprets as 'no limit'. A remote unauthenticated attacker can craft nearby message fetch requests to download an entire channel's message history in a single expensive request, and can send many such requests in parallel, resulting in denial of service through resource exhaustion.
Affected routers (0)
No routers currently mapped to this CVE in our database.