Denial of Service via SVG ViewBox Exploitation in stoatchat

The stoatchat application contains a security vulnerability (CVE-2026-73057) affecting versions prior to 0.15.0, where the proxy endpoint fails to properly validate the 'viewBox' dimensions of user-supplied SVG images. This flaw, classified under CWE-400 (Uncontrolled Resource Consumption), allows remote, unauthenticated attackers to trigger significant memory consumption by submitting SVGs with excessively large width and height values. By sending multiple concurrent requests containing these malformed image payloads to the proxy, an attacker can exhaust system memory across proxy replicas, leading to a Denial of Service (DoS) condition. This issue is particularly critical for deployments utilizing the proxy feature, as it can disrupt the availability of the entire service by forcing the underlying process to allocate excessive memory for image rendering.

Impact

Successful exploitation of this vulnerability leads to service-wide Denial of Service by exhausting host or container memory. This can impact all users of the stoatchat instance, causing instability and potential crashes of proxy replicas. Given the lack of authentication required to hit the proxy endpoint, the barrier to entry for an attacker is minimal.

Recommendation

1. Upgrade all instances of stoatchat to version 0.15.0 or later to apply the necessary input validation for SVG rendering.
2. Implement request rate limiting and payload size restrictions on the proxy endpoint to mitigate the impact of volumetric or resource-intensive requests.
3. Monitor host-level memory usage metrics for application processes; a spike in resident set size (RSS) immediately following requests to the proxy endpoint may indicate exploitation attempts.