5.5
CVE-2026-6607
- EPSS 0.62%
- Veröffentlicht 20.04.2026 05:00:23
- Zuletzt bearbeitet 22.04.2026 20:22:50
- Quelle cna@vuldb.com
- CVE-Watchlists
- Unerledigt
lm-sys fastchat Worker API Endpoint api_generate resource consumption
A security vulnerability has been detected in lm-sys fastchat up to 0.2.36. This issue affects the function api_generate of the component Worker API Endpoint. The manipulation leads to resource consumption. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The identifier of the patch is c9e84b89c91d45191dc24466888de526fa04cf33. It is suggested to install a patch to address this issue. Commit ff66426 patched this issue in api_generate of base_model_worker.py and did miss other entry points.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
Herstellerlm-sys
≫
Produkt
fastchat
Version
0.2.0
Status
affected
Version
0.2.1
Status
affected
Version
0.2.2
Status
affected
Version
0.2.3
Status
affected
Version
0.2.4
Status
affected
Version
0.2.5
Status
affected
Version
0.2.6
Status
affected
Version
0.2.7
Status
affected
Version
0.2.8
Status
affected
Version
0.2.9
Status
affected
Version
0.2.10
Status
affected
Version
0.2.11
Status
affected
Version
0.2.12
Status
affected
Version
0.2.13
Status
affected
Version
0.2.14
Status
affected
Version
0.2.15
Status
affected
Version
0.2.16
Status
affected
Version
0.2.17
Status
affected
Version
0.2.18
Status
affected
Version
0.2.19
Status
affected
Version
0.2.20
Status
affected
Version
0.2.21
Status
affected
Version
0.2.22
Status
affected
Version
0.2.23
Status
affected
Version
0.2.24
Status
affected
Version
0.2.25
Status
affected
Version
0.2.26
Status
affected
Version
0.2.27
Status
affected
Version
0.2.28
Status
affected
Version
0.2.29
Status
affected
Version
0.2.30
Status
affected
Version
0.2.31
Status
affected
Version
0.2.32
Status
affected
Version
0.2.33
Status
affected
Version
0.2.34
Status
affected
Version
0.2.35
Status
affected
Version
0.2.36
Status
affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.62% | 0.451 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| cna@vuldb.com | 5.3 | 3.9 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
|
| cna@vuldb.com | 5.5 | 0 | 0 |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
|
| cna@vuldb.com | 5 | 10 | 2.9 |
AV:N/AC:L/Au:N/C:N/I:N/A:P
|
CWE-400 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CWE-404 Improper Resource Shutdown or Release
The product does not release or incorrectly releases a resource before it is made available for re-use.
https://vuldb.com/vuln/358242
https://vuldb.com/vuln/358242/cti
https://vuldb.com/submit/792227
https://github.com/lm-sys/FastChat/issues/3833
https://github.com/lm-sys/FastChat/pull/3835
https://gist.github.com/YLChen-007/87216a2d97a882d619e11dc67cd473b5
https://github.com/lm-sys/FastChat/commit/c9e84b89c91d45191dc24466888de526fa04cf33
https://github.com/lm-sys/FastChat/