CyberRota Analysis
AI-GeneratedChroma 1.5.9 is vulnerable due to improper validation of maximum bounds on HNSW index parameters, allowing unauthenticated attackers to submit excessively large values in collection-create requests. This can lead to memory exhaustion and result in a denial of service during index compaction. Organizations using Chroma should prioritize patching this vulnerability to prevent potential service disruptions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Chroma 1.5.9 fails to validate maximum bounds on HNSW index parameters max_neighbors, ef_construction, and ef_search in collection-create requests. Unauthenticated attackers can supply arbitrarily large parameter values to exhaust server memory and cause denial of service during index compaction.