CVE-2026-84857 - Vulnerability Details

- sigoden aichat API Endpoint serve.rs memory allocation

Description

A flaw has been found in sigoden aichat up to 0.30.4. This affects an unknown function of the file src/serve.rs of the component API Endpoint. This manipulation causes uncontrolled memory allocation. The attack can be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Published: 2026-09-02

Score: 6.9 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A flaw has been identified in the sigoden aichat API endpoint defined in src/serve.rs that allows attackers to trigger uncontrolled memory allocation. This vulnerability can be exploited remotely and may enable an attacker to exhaust system resources, resulting in denial of service. The issue is classified under CWE-400 (Unvalidated Input) and CWE-789 (Uncontrolled Memory Allocation).

Affected Systems

The affected vendor is sigoden, product aichat. Versions up to and including 0.30.4 are vulnerable. The specific function impacted within serve.rs is not clearly documented, but the flaw is present in the component API endpoint that processes incoming requests.

Risk and Exploitability

The CVSS score of 6.9 indicates a moderate severity. While the EPSS score is not available, the vulnerability has an active published exploit and can be launched remotely. It is not yet listed in CISA KEV. Attackers could use the remote exploitation path to trigger excessive memory allocation and bring the service down. The lack of vendor response underscores the urgency of applying a fix or mitigating controls.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

sigoden

aichat

affected

Version	Status	Constraints
`0.30.0`	affected	—
`0.30.1`	affected	—
`0.30.2`	affected	—
`0.30.3`	affected	—
`0.30.4`	affected	—

No data.

Vendor Product Confidence Versions

Sigoden

Aichat

100%

Version	Status	Scheme	Platform
`0.30.0`	affected	semver	—
`0.30.1`	affected	semver	—
`0.30.2`	affected	semver	—
`0.30.3`	affected	semver	—
`0.30.4`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade to the latest sigoden aichat release (0.30.5 or newer) where the memory allocation bug is fixed.
Implement request payload size limits and validate incoming data to prevent exploitation of uncontrolled allocation.
Apply rate limiting or request throttling to the API endpoint to reduce the impact of a potential denial‑of‑service attack.
Monitor system memory and application health metrics for unusually high usage patterns that could indicate exploitation attempts.
Regularly check the vendor’s security advisories for updates or patches.

Generated by OpenCVE AI on September 3, 2026 at 09:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.00372.

Exploitation poc

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/outlookgp/CVE/tree/main/AIChat_Serve_Request_Body_DoS_Report
https://vuldb.com/cve/CVE-2026-84857
https://vuldb.com/submit/886265
https://vuldb.com/vuln/398132
https://vuldb.com/vuln/398132/cti

History

Thu, 03 Sep 2026 17:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 02 Sep 2026 20:15:00 +0000

Type	Values Removed	Values Added
Description		A flaw has been found in sigoden aichat up to 0.30.4. This affects an unknown function of the file src/serve.rs of the component API Endpoint. This manipulation causes uncontrolled memory allocation. The attack can be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title		sigoden aichat API Endpoint serve.rs memory allocation
First Time appeared		Sigoden Sigoden aichat
Weaknesses		CWE-400 CWE-789
CPEs		cpe:2.3:a:sigoden:aichat::::::::
Vendors & Products		Sigoden Sigoden aichat
References		https://github.com/outlookgp/CVE/tree/main/AIChat_Serve_Request_Body_DoS_Report https://vuldb.com/cve/CVE-2026-84857 https://vuldb.com/submit/886265 https://vuldb.com/vuln/398132 https://vuldb.com/vuln/398132/cti
Metrics		cvssV2_0 `{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:ND/RC:UR'}` cvssV3_0 `{'score': 5.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R'}` cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R'}` cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P'}`

Subscriptions

Sigoden Aichat

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-09-02T20:00:08.589Z

Updated: 2026-09-03T15:36:18.054Z

Reserved: 2026-09-02T13:25:34.895Z

Link: CVE-2026-84857

Vulnrichment

Updated: 2026-09-03T15:36:14.880Z

NVD

Status : Deferred

Published: 2026-09-02T20:17:42.753

Modified: 2026-09-03T17:25:25.113

Link: CVE-2026-84857

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-03T10:30:12Z

Weaknesses

CWE-400
Uncontrolled Resource Consumption
CWE-789
Memory Allocation with Excessive Size Value

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

Exploitation poc

Automatable yes

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object