EUVD-2026-23778
GHSA-5h65-jx66-j7p5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionCVE.org
A security vulnerability has been detected in lm-sys fastchat up to 0.2.36. This issue affects the function api_generate of the component Worker API Endpoint. The manipulation leads to resource consumption. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The identifier of the patch is c9e84b89c91d45191dc24466888de526fa04cf33. It is suggested to install a patch to address this issue. Commit ff66426 patched this issue in api_generate of base_model_worker.py and did miss other entry points.
AnalysisAI
Resource exhaustion in lm-sys FastChat up to 0.2.36 allows remote attackers to trigger denial of service by sending manipulated requests to the Worker API Endpoint's api_generate function. The vulnerability has publicly available exploit code and is confirmed patched upstream, though the fix in commit c9e84b89c91d45191dc24466888de526fa04cf33 addresses only the primary entry point in base_model_worker.py while missing other vulnerable code paths. EPSS score of 5.5 (CVSS 4.0) indicates low to moderate real-world exploitation probability despite public exploit availability.
Technical ContextAI
FastChat is an open-source LLM serving framework that exposes a Worker API Endpoint for distributed inference. The vulnerability resides in the api_generate function of the Worker API component, which processes inference requests. CWE-400 (Uncontrolled Resource Consumption) indicates the vulnerability allows attackers to exhaust system resources such as memory, CPU, or file descriptors through crafted API requests. The attack vector is network-based with low complexity (AC:L), meaning no special network conditions are required. The underlying issue stems from insufficient input validation or rate limiting on the api_generate endpoint, permitting attackers to submit resource-intensive requests without proportional resource accounting or request throttling.
RemediationAI
Apply the upstream patch from commit c9e84b89c91d45191dc24466888de526fa04cf33 (referenced in GitHub PR #3835 at https://github.com/lm-sys/FastChat/pull/3835) to address the vulnerability in the api_generate function of base_model_worker.py. However, note that this patch addresses only the primary entry point and does not cover other vulnerable code paths identified in the CVE. After patching, audit alternative API endpoints in the Worker API component for similar resource consumption vulnerabilities. If immediate patching is not possible, implement compensating controls: rate-limit requests to the Worker API Endpoint at the reverse proxy or load balancer level (trade-off: may reduce legitimate high-throughput inference workloads), restrict network access to the Worker API to trusted infrastructure only (trade-off: reduces flexibility in distributed deployments), and monitor system resource utilization (CPU, memory, file descriptors) for anomalous spikes indicating resource exhaustion attempts. Additionally, verify whether newer FastChat versions beyond 0.2.36 have been released with a more comprehensive fix addressing the missed entry points.
A Server-Side Request Forgery (SSRF) vulnerability exists in the POST /worker_generate_stream API endpoint of the Contro
A Denial of Service (DoS) vulnerability exists in the file upload feature of lm-sys/fastchat version 0.2.36. Rated high
A Server-Side Request Forgery (SSRF) vulnerability exists in lm-sys/fastchat version 0.2.36. Rated high severity (CVSS 7
A Server-Side Request Forgery (SSRF) vulnerability was identified in the lm-sys/fastchat web server, specifically in the
In lm-sys/fastchat Release v0.2.36, the server fails to handle excessive characters appended to the end of multipart bou
An open redirect vulnerability in lm-sys/fastchat Release v0.2.36 allows a remote unauthenticated attacker to redirect u
Information disclosure in lm-sys FastChat up to version 0.2.36 allows remote unauthenticated attackers to manipulate the
Server-side request forgery and model spoofing in lm-sys FastChat let unauthenticated remote attackers register arbitrar
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today