CVE-2026-100675 Details
Description
stoatchat versions before 0.15.5 contain a denial of service vulnerability in the acknowledgement worker that processes mass mention messages. Authenticated users can send five crafted role-mention messages to terminate all acknowledgement workers, disabling push notifications and mention badges deployment-wide until the API process restarts.
A denial-of-service vulnerability has been identified in stoatchat versions prior to 0.15.5. The issue resides in the acknowledgement worker responsible for processing mass mention messages. Authenticated users can exploit this vulnerability by sending five crafted role-mention messages, which terminate all acknowledgement workers. This disruption disables push notifications and mention badges for the entire deployment until the API process is manually restarted.
Users are advised to update to stoatchat version 0.15.5 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 26, 2026CISA-ADP
Assessed Sep 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/stoatchat/stoatchat/security/advisories/GHSA-5gq6-v4cf-3qq8 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/stoatchat/stoatchat/security/advisories/GHSA-5gq6-v4cf-3qq8 | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/stoatchat-before-0.15.5-denial-of-service-via-mass-mentions | [email protected] | AdvisoryVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-248 | Uncaught Exception | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| stoatchat | <= 0.15.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 28, 2026 | CVE Modified | CISA-ADP |
| Sep 26, 2026 | New CVE Received | [email protected] |