CVE-2026-85664: Allocation of Resources Without Limits or Throttling in chroma-core chroma

CVE-2026-85664 affects chroma-core's chroma product, specifically version 1.5.9 and earlier. The vulnerability arises because the software fails to validate maximum bounds on the HNSW index parameters max_neighbors, ef_construction, and ef_search in collection-create requests. An unauthenticated attacker can exploit this by providing arbitrarily large values for these parameters, causing excessive resource allocation that exhausts server memory and results in denial of service during the index compaction process.

Successful exploitation can cause denial of service by exhausting server memory resources, impacting availability of the chroma service. There is no indication of privilege escalation, data disclosure, or integrity impact from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to collection-create functionality and monitor for abnormal parameter values to mitigate potential exploitation.