Serge CVE-2026-6588

Immediate action: update serge-chat serge to a version newer than 1.4TB if available from the official repository. As the vendor has not responded to disclosure notification, check the serge-chat GitHub repository (github.com/serge-chat/serge) for any available patches or security releases. If no patched version is available, implement the following compensating controls: (1) Deploy serge behind a reverse proxy or API gateway that enforces authentication for all requests to /api/*/download_model and /api/*/delete_model endpoints, injecting valid authentication tokens or session headers before forwarding to the backend serge instance; (2) Use firewall or network ACL rules to restrict access to the serge API port to only trusted internal networks or specific IP addresses, blocking direct remote access; (3) Disable or remove the download_model and delete_model endpoints entirely if not in active use, by modifying the routers configuration or deploying a wrapper that returns 403 Forbidden for these paths; (4) Implement rate limiting at the network edge to mitigate automated attacks against model deletion operations. Trade-offs include operational overhead from authentication layer management and potential functionality loss if endpoints are disabled. Monitor serge releases at https://vuldb.com/vuln/358223 for vendor patches.