CVE-2026-85664: Chroma 1.5.9 Unbounded HNSW Index Parameters Memory Exhaustion
Chroma 1.5.9 fails to validate maximum bounds on HNSW index parameters maxneighbors, efconstruction, and efsearch in collection-create requests. Unauthenticated attackers can supply arbitrarily large parameter values to exhaust server memory and cause denial of service during index compaction.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Any Chroma 1.5.9 deployment that accepts unauthenticated collection-create requests is exposed. The affected parameters are max_neighbors, ef_construction, and ef_search in HNSW index configuration.
What does an attacker need to exploit it?
An attacker only needs network access to submit a collection-create request; no authentication or user interaction is required. They can provide arbitrarily large HNSW parameter values, causing memory exhaustion during index compaction.
What is the impact of successful exploitation?
Successful exploitation can exhaust server memory and deny service. The provided impact data indicates availability impact only, with no stated confidentiality or integrity impact.