CyberRota Analysis
AI-GeneratedThe vulnerability exists in stoatchat (delta) versions prior to 20250210-1 (0.8.2), where a logic error allows remote unauthenticated attackers to exploit the message fetching functionality. By setting a message limit of zero, attackers can retrieve an entire channel's message history in a single request, leading to potential denial of service through resource exhaustion. Organizations using affected versions should prioritize patching to mitigate the risk of data exposure and service disruption.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
stoatchat (delta) versions before 20250210-1 (0.8.2) contain a logic error in the query messages route. When fetching messages 'nearby' another message, the database query can be given a message limit of zero, which the database interprets as 'no limit'. A remote unauthenticated attacker can craft nearby message fetch requests to download an entire channel's message history in a single expensive request, and can send many such requests in parallel, resulting in denial of service through resource exhaustion.