Security Advisory
CVE-2026-85664
7.5
HIGH
Vulnerability Description
Chroma 1.5.9 fails to validate maximum bounds on HNSW index parameters max_neighbors, ef_construction, and ef_search in collection-create requests. Unauthenticated attackers can supply arbitrarily large parameter values to exhaust server memory and cause denial of service during index compaction.
Published Date
September 4, 2026
Official Source
NIST NVD Advisory