CVE-2026-100675 in stoatchat
Summary
by MITRE • 09/26/2026
stoatchat versions before 0.15.5 contain a denial of service vulnerability in the acknowledgement worker that processes mass mention messages. Authenticated users can send five crafted role-mention messages to terminate all acknowledgement workers, disabling push notifications and mention badges deployment-wide until the API process restarts.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/26/2026
The identified security flaw resides within stoatchat versions prior to 0.15.5, specifically targeting the internal mechanism responsible for processing mass mention acknowledgements. This vulnerability manifests as a denial of service condition that can be exploited by authenticated users who possess the ability to send role-mention messages. The core technical issue lies in how the application handles concurrent requests from multiple acknowledgement workers when faced with high-volume or crafted input patterns. When an attacker sends five specifically constructed role-mention messages, it triggers a resource exhaustion state within the acknowledgement worker subsystem. This action effectively terminates all active acknowledgement workers, which are critical components for managing real-time user interactions and notifications within the platform.
The operational impact of this vulnerability is significant because it disrupts core communication features across the entire deployment. By disabling the acknowledgement workers, the system becomes incapable of processing incoming mentions or delivering push notifications to end users. This results in a widespread outage where legitimate users do not receive alerts for new messages or interactions, effectively breaking the real-time aspect of the chat application. The service remains partially functional but loses its ability to maintain user engagement signals such as mention badges and notification deliveries. Recovery from this state requires manual intervention by system administrators to restart the API process, leading to potential downtime and operational disruption until normal services are restored.
From a classification perspective, this vulnerability aligns with CWE-400, which describes uncontrolled resource consumption, specifically in the context of denial of service attacks that exhaust server-side resources such as threads or worker processes. The attack vector leverages authenticated access, indicating that it falls under CWE-780, which covers improper authorization checks allowing attackers to perform actions they should not be permitted to do if those actions lead to system instability. In terms of the MITRE ATT&CK framework, this behavior is consistent with T1499 Endpoint Denial of Service or potentially T1529 System Shutdown/Reboot depending on how the worker termination affects overall service availability. The exploitation requires authentication, which places it within the scope of authenticated attacks rather than remote unauthenticated exploits.
Mitigation strategies should focus primarily on upgrading to stoatchat version 0.15.5 or later where this flaw has been addressed by developers through improved resource management and input validation in the acknowledgement worker logic. Until an upgrade is feasible, administrators can implement rate limiting policies at the network level or within the application configuration to restrict the number of role-mention messages a single authenticated user can send within a specific time window. This limits the ability of attackers to trigger the five-message threshold required to crash the workers. Additionally, implementing automatic restart mechanisms for worker processes upon failure detection can reduce downtime, although this is a compensatory control rather than a fix for the underlying code defect. Regular security audits and penetration testing focused on authentication bypasses and resource exhaustion scenarios are recommended to identify similar weaknesses in other components of the application stack.