ChromaDB Unbounded HNSW Parameters: Memory Exhaustion DoS Analysis

Key Vulnerability Information Summary Vulnerability Overview Title: Type: DoS (Denial of Service) caused by memory exhaustion / compaction worker crash Root Cause: The , , and fields in the HNSW index configuration lack checks in and . An attacker can pass extremely large values via the API, causing memory allocation of bytes, exhausting memory and crashing the compaction worker process. Severity: (label) Status: Open Scope of Impact Affected Components: The , , and parameters of the HNSW vector index. Trigger Path: - A client passes an extremely large value (e.g., 30,000,000) in a request, allocating approximately 710 MB of memory. - Extremely large values can similarly be passed in . - In the default OSS single-node deployment, the endpoint is unauthenticated ( allows unauthenticated access for ), so any user can trigger it. Consequences: Memory exhaustion / OOM, compaction subsystem crash, and persistent corruption of the affected collection. CVE Association: Unrelated to (RCE in the legacy FastAPI server); this vulnerability is an independent DoS. PoC Code Proposed Fix Core Fix: In , add upper-bound validation for , , and (consistent with ). Reuse Existing Validation: is already called in ; only upper bounds need to be added to the three structs, no new mechanisms required. Suggested Upper Bounds: The practical upper limit for is approximately 128; reasonable upper limits (e.g., 1024) can be set for / . Supplement: The Python client also needs to have upper bounds added to prevent clients from bypassing validation. Regression Tests: Add boundary tests in to ensure both create and update paths enforce the upper bounds. Related PR: (PR submitted to close this issue).

Goal Reached Thanks to every supporter — we hit 100%!

ChromaDB Unbounded HNSW Parameters: Memory Exhaustion DoS Analysis

More from this source