Easy Chat Server 3.1 contains a denial of service vulnerability that allows remote attackers to crash the application by sending oversized data in the message parameter. By establishing a session via the chat.ghp endpoint and then sending a POST request to body2.ghp with an excessively large message payload, the service crashes, which results in an interruption of availability for users of the chat server. This disruption could be exploited to hinder legitimate users’ access to real‑time communication.

The vulnerability affects Easy Chat Server version 3.1, distributed by the vendor Echatserver. Only this version and component are listed as affected; no other releases are known to be impacted.

The CVSS score of 8.7 indicates a high‑severity denial of service flaw. Though EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, the remote nature of the attack and lack of input validation keep the risk elevated. An attacker can exploit it by sending a large HTTP POST parameter to the body2.ghp endpoint from any network that can reach the server, leading to service crashes without affecting confidentiality or integrity.