CVE-2026-84857: Uncontrolled Memory Allocation in sigoden aichat

This vulnerability in sigoden aichat (versions 0.30.0 through 0.30.4) allows remote attackers to trigger uncontrolled memory allocation via an unknown function in the src/serve.rs file of the API Endpoint. The issue can be exploited without privileges or user interaction, potentially leading to resource exhaustion. The vendor was contacted but did not respond, and no remediation or patch has been disclosed. The CVSS 4.0 base score is 6.9 (medium severity), reflecting the network attack vector and low complexity without required privileges or user interaction.

Successful exploitation can cause uncontrolled memory allocation remotely, which may lead to denial of service or resource exhaustion on the affected system. No further impact details are provided. There is no indication of privilege escalation or data compromise in the available information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch or workaround is available, users should monitor official sources for updates. Until a fix is released, consider limiting exposure of the affected API endpoint to untrusted networks.