stoatchat versions before 0.15.0 accept SVG files without validating the viewBox width and height values in the proxy endpoint. An attacker can supply malicious SVGs with extreme dimension values, causing the server to allocate large amounts of memory for rendering. This leads to a resource exhaustion condition that can exhaust the memory of the host and result in service interruption. The weakness is captured by CWE‑400, representing a classic resource exhaustion flaw.

The vulnerability affects all releases of stoatchat before version 0.15.0. No specific sub‑versions are listed, so any installation running a pre‑0.15.0 build of the stoatchat application is at risk.

The CVSS score of 8.7 classifies the issue as high severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, implying it has not yet been observed as exploited in the wild. The attack vector is remote: an adversary can send crafted SVGs to the exposed proxy endpoint, and by dispatching multiple concurrent requests on shared proxy replicas, they can trigger memory exhaustion without needing authentication or privileged access.