Fastchat CVE-2026-6607

Remote attackers can exploit this vulnerability without authentication or user interaction against any FastChat deployment exposing the Worker API Endpoint on a network-accessible interface. The vulnerability is triggered by sending manipulated requests to the api_generate function; no special FastChat configuration, feature enablement, or non-standard deployment mode is required - default installations are vulnerable. Exploitation is limited by the fact that most modern load balancers and reverse proxies implement default rate limiting or request queue management, which may naturally throttle the attack, and by the requirement for sustained or repeated requests to exhaust resources, as single requests cannot instantaneously cause denial of service in well-architected systems.

Multiple signals present conflicting risk profiles. CVSS 4.0 with a low severity rating (VA:L - partial availability impact) contrasts with the public exploit availability (E:P), suggesting this is a real but limited-scope threat. The attack requires no authentication (PR:N) or user interaction (UI:N), favoring exploitation, yet the EPSS score of 5.5 remains moderate, possibly because resource consumption attacks typically require sustained or repeated requests and are not as immediately impactful as code execution vulnerabilities. The critical limitation is architectural: the patch (commit c9e84b89c91d45191dc24466888de526fa04cf33) addresses only the primary api_generate entry point in base_model_worker.py, while the CVE notes explicitly state 'did miss other entry points.' This means organizations deploying patched versions may remain vulnerable through alternative API endpoints. KEV status is not indicated in the input, suggesting this is not yet listed as actively exploited by CISA, despite public POC availability. Real-world risk depends heavily on whether the organization runs FastChat in a resource-constrained environment or exposes the Worker API to untrusted networks without rate limiting.

An attacker sends a series of specially crafted requests to the Worker API Endpoint's api_generate function, each designed to consume excessive memory or CPU resources. Because the endpoint requires no authentication (PR:N) and allows remote network access (AV:N), the attacker can launch this attack from any network location. Repeated or sustained requests exhaust the FastChat worker's resources, degrading or halting its ability to serve legitimate inference requests, effectively disabling the service.