CVE-2025-71377None▾ Sunlitstoatchat (delta) versions before 20250210-1 (0.8.2) contain a logic error in the query messages route. When fetching messages 'nearby' another message, the database query can be given a message limit of zero, which the database interpre…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.7%
Last analysed / modified upstream
stoatchat (delta) versions before 20250210-1 (0.8.2) contain a logic error in the query messages route. When fetching messages 'nearby' another message, the database query can be given a message limit of zero, which the database interprets as 'no limit'. A remote unauthenticated attacker can craft nearby message fetch requests to download an entire channel's message history in a single expensive request, and can send many such requests in parallel, resulting in denial of service through resource exhaustion.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
GHSA-79qw-g39g-mfxcHigh· 8.1Duplicate Advisory: Keycloak vulnerable to authorization bypass via incorrect uri comparison
CVE-2026-114649Medium· 6.8Authentication bypass via issuer-and-serial-only certificate equality in shared cluster cache
CVE-2026-98484Low· 3.4netfilter: nf_tables: skip expired catchall elements on insert and delete
CVE-2026-98497Medium· 5.6kernel: net/mlx5e: fix swapped IPv6 IPsec policy masks (CVE-2026-98497)
CVE-2026-98572Medium· 4.4kernel: bpf: Fix immediate JMP JEQ/JNE on MIPS32 (CVE-2026-98572)
CVE-2026-98577Medium· 5.3kernel: nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap() (CVE-2026-98577)