What’s Vulnerable › Vulnerabilities

CVE-2025-71377: stoatchat before 20250210-1 Unrestricted Message History Fetch

• Severity: high (CVSS 8.7 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-16 · updated 2026-10-06
• Weakness: CWE-1025

Description

stoatchat (delta) versions before 20250210-1 (0.8.2) contain a logic error in the query messages route. When fetching messages 'nearby' another message, the database query can be given a message limit of zero, which the database interprets as 'no limit'. A remote unauthenticated attacker can craft nearby message fetch requests to download an entire channel's message history in a single expensive request, and can send many such requests in parallel, resulting in denial of service through resource exhaustion.

Affected products

• stoatchat: before 0.8.2 — fixed in 0.8.2

How to fix

Upgrade to a fixed version: stoatchat 0.8.2. Check the vendor advisory for mitigations.

References

• https://github.com/stoatchat/stoatchat/commit/5f84daa9dba34c103cd83a2ee1f5e5ba900bfe94
• https://github.com/stoatchat/stoatchat/security/advisories/GHSA-h7h6-7pxm-mc66
• https://www.vulncheck.com/advisories/stoatchat-before-20250210-1-unrestricted-message-history-fetch

Get alerted when CVE-2025-71377 or the next vulnerability affects your stack