{"id":"CVE-2026-85664","title":"Chroma 1.5.9 fails to validate maximum bounds on HNSW index parameters max_neighbors, ef_construction, and ef_search in collection-create requests","summary":"Chroma 1.5.9 fails to validate maximum bounds on HNSW index parameters max_neighbors, ef_construction, and ef_search in collection-create requests. Unauthenticated attackers can supply arbitrarily large parameter values to exhaust server…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-770","CWE-1284"],"vendor":"chroma-core","product":"chroma","affected":["chroma <= 1.5.9"],"published":"2026-09-04","updated":"2026-09-10","sourceUpdated":"2026-09-10T16:18:00.510","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85664","references":[{"url":"https://github.com/chroma-core/chroma","label":"disclosure@vulncheck.com"},{"url":"https://github.com/chroma-core/chroma/blob/1.5.9/rust/frontend/src/auth/mod.rs","label":"disclosure@vulncheck.com"},{"url":"https://github.com/chroma-core/chroma/blob/1.5.9/rust/types/src/hnsw_configuration.rs","label":"disclosure@vulncheck.com"},{"url":"https://github.com/chroma-core/chroma/issues/7225","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/chroma-1.5.9-unbounded-hnsw-index-parameters-memory-exhaustion","label":"disclosure@vulncheck.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-85664.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-85664"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2531492"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-85664"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85664"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-09-10T14:23:02.954885Z"},"epss":0.00366,"epssPercentile":0.30328,"ingestedAt":"2026-09-10T15:53:17.107Z","slug":"CVE-2026-85664","body":"## Overview\n\nChroma 1.5.9 fails to validate maximum bounds on HNSW index parameters max_neighbors, ef_construction, and ef_search in collection-create requests. Unauthenticated attackers can supply arbitrarily large parameter values to exhaust server memory and cause denial of service during index compaction.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · updated 2026-09-11 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-85664.json)","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}