CVE-2026-84857: sigoden aichat API Endpoint serve.rs memory allocation
A flaw has been found in sigoden aichat up to 0.30.4. This affects an unknown function of the file src/serve.rs of the component API Endpoint. This manipulation causes uncontrolled memory allocation. The attack can be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments of sigoden aichat up to version 0.30.4 that expose the affected API endpoint to remote clients are exposed. The issue can be initiated remotely and does not require authentication or user interaction according to the provided severity vector.
What could exploitation do to an affected service?
Successful exploitation causes uncontrolled memory allocation in the API endpoint, which can reduce service availability. The supplied impact information indicates an availability impact, with no stated confidentiality or integrity impact.
Is there public exploit activity to consider during triage?
An exploit has been published and may be used. Prioritize systems with remotely reachable API endpoints because the attack complexity is listed as low and no privileges are required.
What can be done if an update is not immediately available?
The provided information does not identify a vendor fix or specific workaround. Reduce exposure by limiting remote access to the affected API endpoint until the deployment can be moved beyond version 0.30.4.