Chroma 1.5.9 fails to enforce upper bounds on the HNSW index parameters max_neighbors, ef_construction, and ef_search when a collection is created. An unauthenticated attacker can submit collection‑create requests with arbitrarily large values for these fields. During index compaction the server allocates memory proportional to the supplied limits, so the unbounded sizes can exhaust system RAM and trigger a process termination or freeze, resulting in a denial‑of‑service condition. The weakness is tied to improper resource management (CWE‑770) and unchecked input bounds (CWE‑1284).

The vulnerability affects only the chroma‑core:chroma product running version 1.5.9. No other released versions are listed as affected in the advisory.

The CVSS score of 8.7 indicates high severity. The EPSS score is < 1%, reflecting a very low current exploitation probability, but the vulnerability remains exploitable with remote, unauthenticated input. The attack vector is the collection‑create API endpoint, which is reachable over the network. Since no authentication is required, any host exposing this endpoint could be impacted. The vulnerability is not listed in the CISA KEV catalog, yet it should be treated as significant due to the potential for system‑wide denial of service.