CVE-2026-85664

EUVD-2026-71120
Chroma 1.5.9 fails to validate maximum bounds on HNSW index parameters max_neighbors, ef_construction, and ef_search in collection-create requests. Unauthenticated attackers can supply arbitrarily large parameter values to exhaust server memory and cause denial of service during index compaction.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/chroma-core/chroma
https://github.com/chroma-core/chroma/blob/1.5.9/rust/frontend/src/auth/mod.rs
https://github.com/chroma-core/chroma/blob/1.5.9/rust/types/src/hnsw_configuration.rs
https://github.com/chroma-core/chroma/issues/7225
https://www.vulncheck.com/advisories/chroma-1.5.9-unbounded-hnsw-index-parameters-memory-exhaustion