CVE-2026-100675: stoatchat before 0.15.5 Denial of Service via mass mentions
stoatchat versions before 0.15.5 contain a denial of service vulnerability in the acknowledgement worker that processes mass mention messages. Authenticated users can send five crafted role-mention messages to terminate all acknowledgement workers, disabling push notifications and mention badges deployment-wide until the API process restarts.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
stoatchatto a version that resolves this vulnerability.Fixed in 0.15.5
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user can exploit it. The attack requires the ability to send crafted role-mention messages; no user interaction is required.
What is the operational impact if exploitation succeeds?
Five crafted role-mention messages can terminate all acknowledgement workers. Push notifications and mention badges are then disabled across the deployment until the API process restarts.
Are deployments on the affected version range exposed by default?
The provided information identifies the acknowledgement worker's processing of mass mention messages as the affected path, but it does not state whether role mentions or the affected worker are enabled in a default configuration.
How can administrators recover if they cannot patch immediately?
Restarting the API process restores the acknowledgement workers after an attack. The provided information does not identify a mitigation that prevents authenticated users from triggering the condition before upgrading.