Vendor
chroma-core
2 known vulnerabilities.
Products
2 results · Clear filters · Feed
-
High 8.1
Chroma through 1.5.9 Authorization Bypass via Collection Identifier
Chroma through 1.5.9 fails to validate tenant and database segments when resolving collections, allowing authenticated attackers to access collections from other tenants by knowing the collection identifier. Attackers can read, modify, and update records in f…
-
High 7.5
Chroma 1.5.9 Unbounded HNSW Index Parameters Memory Exhaustion
Chroma 1.5.9 fails to validate maximum bounds on HNSW index parameters max_neighbors, ef_construction, and ef_search in collection-create requests. Unauthenticated attackers can supply arbitrarily large parameter values to exhaust server memory and cause deni…