stoatchat versions prior to 20250210-1 contain a logic error (CWE-1025) in the query messages route. When fetching messages near another message, a zero limit parameter causes the database to treat it as "no limit," allowing an attacker to retrieve an entire channel's history in a single expensive request. The attacker can send many such requests in parallel, leading to denial of service through resource exhaustion.

The vulnerability affects stoatchat:stoatchat, specifically all releases before 20250210-1 (0.8.2).

The CVSS score of 8.7 indicates high severity, with an EPSS score of 0.00383 (less than 1%) and the vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the flaw by issuing unauthenticated requests to the messages endpoint with a zero limit parameter, which results in unrestricted data access and potential DoS from parallel heavy requests. The attack vector is remote and does not require authentication.