GitHub Advisoryadvisory · PyPI

GHSA-qg86-f892-m4hj FastChat Uncontrolled Resource Consumption vulnerability

HIGH Published 2025-03-20 Modified 2025-03-21 Official page ↗
Aliases
CVE-2024-10907
Ecosystem
PyPI
Packages
fschat
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400, CWE-835
Reviewed
2025-03-21

Affected packages

• PyPI fschat: <= 0.2.36 (no fix yet)

Description

In lm-sys/fastchat Release v0.2.36, the server fails to handle excessive characters appended to the end of multipart boundaries. This flaw can be exploited by sending malformed multipart requests with arbitrary characters at the end of the boundary. Each extra character is processed in an infinite loop, leading to excessive resource consumption and a complete denial of service (DoS) for all users. The vulnerability is unauthenticated, meaning no user login or interaction is required for an attacker to exploit this issue.

Related

Alias · CVE (1)

  • CVE-2024-10907 In lm-sys/fastchat Release v0.2.36, the server fails to handle excessive characters appended to the end of multipart boundaries. vulnerability

Weakness · CWE (2)

  • CWE-400 Uncontrolled Resource Consumption weakness
  • CWE-835 Loop with Unreachable Exit Condition weakness

References