What is GHSA-4rgf-ww29-jxx4?

GHSA-4rgf-ww29-jxx4 is a security advisory published by GitHub Security Advisories with High severity. stoatchat before 0.15.0 fails to validate SVG viewBox dimensions in the proxy endpoint, allowing...

Which CVE IDs does GHSA-4rgf-ww29-jxx4 cover?

GHSA-4rgf-ww29-jxx4 covers the following CVE IDs: CVE-2026-73057. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-4rgf-ww29-jxx4?

GHSA-4rgf-ww29-jxx4 has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

GHSA-4rgf-ww29-jxx4HighCVSS 7.5

stoatchat before 0.15.0 fails to validate SVG viewBox dimensions in the proxy endpoint, allowing...

Vendor

GitHub Security Advisories

Published

August 16, 2026

Last Modified

August 16, 2026

🔗 CVE IDs covered (1)

CVE-2026-73057 →

📋 Description

stoatchat before 0.15.0 fails to validate SVG viewBox dimensions in the proxy endpoint, allowing attackers to cause denial of service by memory exhaustion. Attackers can host malicious SVGs with extremely large width and height values and trigger concurrent requests to exhaust available memory across proxy replicas.

🔗 References (4)

https://github.com/stoatchat/stoatchat/security/advisories/GHSA-x87r-h3mq-7mgr
https://nvd.nist.gov/vuln/detail/CVE-2026-73057
https://www.vulncheck.com/advisories/stoatchat-before-uncapped-svg-rendering-denial-of-service
https://github.com/advisories/GHSA-4rgf-ww29-jxx4