CVE-2025-71377

Name of the Vulnerable Software and Affected Versions stoatchat (delta) versions prior to 20250210-1 (0.8.2)

Description A logic error exists in the query messages route. When fetching messages nearby another message, the database query can be assigned a message limit of zero, which the database interprets as having no limit. A remote unauthenticated attacker can exploit this by crafting requests to download the entire message history of a channel in a single request. Sending multiple such requests in parallel can lead to a denial of service through resource exhaustion.

Recommendations Update stoatchat (delta) to version 20250210-1 (0.8.2) or later.