CVE-2026-85664

HIGH 7.5

Chroma 1.5.9 Unbounded HNSW Index Parameters Memory Exhaustion

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

Chroma 1.5.9 fails to validate maximum bounds on HNSW index parameters max_neighbors, ef_construction, and ef_search in collection-create requests. Unauthenticated attackers can supply arbitrarily large parameter values to exhaust server memory and cause denial of service during index compaction.

CWE	CWE-770
Vendor	chroma-core
Product	chroma
Published	Sep 4, 2026
Last Updated	Sep 10, 2026

Stay Ahead of the Next One

Get instant alerts for chroma-core chroma

Be the first to know when new high vulnerabilities affecting chroma-core chroma are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

chroma-core / chroma

0 ≤ 1.5.9

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/chroma-core/chroma/issues/7225 github.com: https://github.com/chroma-core/chroma github.com: https://github.com/chroma-core/chroma/blob/1.5.9/rust/types/src/hnsw_configuration.rs github.com: https://github.com/chroma-core/chroma/blob/1.5.9/rust/frontend/src/auth/mod.rs vulncheck.com: https://www.vulncheck.com/advisories/chroma-1.5.9-unbounded-hnsw-index-parameters-memory-exhaustion

Credits

George Chen