Is CVE-2026-85664 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-85664?

CVE-2026-85664 has a CVSS v3 severity of HIGH (7.5).

Back

CVE-2026-85664

Description

Chroma 1.5.9 fails to validate maximum bounds on HNSW index parameters max_neighbors, ef_construction, and ef_search in collection-create requests. Unauthenticated attackers can supply arbitrarily large parameter values to exhaust server memory and cause denial of service during index compaction.