CVE-2024-10907highCWE-835

CVE-2024-10907: fallo de gravedad alta en lm-sys/fastchat

Denial of Service (DoS) via Multipart Boundary in lm-sys/fastchat

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear lm-sys/fastchat+ Monitorear fschat

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.5epss 0.7%
In lm-sys/fastchat Release v0.2.36, the server fails to handle excessive characters appended to the end of multipart boundaries. This flaw can be exploited by sending malformed multipart requests with arbitrary characters at the end of the boundary. Each extra character is processed in an infinite loop, leading to excessive resource consumption and a complete denial of service (DoS) for all users. The vulnerability is unauthenticated, meaning no user login or interaction is required for an attacker to exploit this issue.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Productos afectados
lm-sys · lm-sys/fastchat
CVEs relacionadas — lm-sys/fastchat

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-10908MEDIUMOpen Redirect in lm-sys/fastchatEPSS 0.8%CVE-2024-12376HIGHServer Side Request Forgery in lm-sys/fastchatEPSS 0.8%CVE-2024-11603HIGHServer-Side Request Forgery in lm-sys/fastchatEPSS 0.7%CVE-2024-10912HIGHDenial of Service in lm-sys/fastchatEPSS 0.6%CVE-2024-10044CRITICALSSRF in POST /worker_generate_stream API endpoint in lm-sys/fastchatEPSS 0.5%