CVE-2026-85664 Details

A denial-of-service vulnerability has been identified in Chroma version 1.5.9, where the application fails to properly validate maximum limits on HNSW index parameters in collection creation requests. This oversight allows unauthenticated attackers to submit excessively large values for 'max_neighbors', 'ef_construction', and 'ef_search', leading to severe memory exhaustion. During the index compaction process, the server allocates substantial memory based on these parameters, causing the application to run out of resources and crash. The issue arises because the default authentication method in Chroma's open-source version authorizes all requests, leaving the application vulnerable to exploitation.

To address this vulnerability, it is recommended to implement proper validation on the HNSW index parameters 'max_neighbors', 'ef_construction', and 'ef_search' during collection creation. This validation should include enforcing maximum limits to prevent excessive memory allocation, while still allowing reasonable values for legitimate use cases.