CVE-2026-6607

MEDIUM

lm-sys fastchat Worker API Endpoint api_generate resource consumption

Title source: cna
STIX 2.1

Description

A security vulnerability has been detected in lm-sys fastchat up to 0.2.36. This issue affects the function api_generate of the component Worker API Endpoint. The manipulation leads to resource consumption. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The identifier of the patch is c9e84b89c91d45191dc24466888de526fa04cf33. It is suggested to install a patch to address this issue. Commit ff66426 patched this issue in api_generate of base_model_worker.py and did miss other entry points.

References (8)

Core 8
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-358242 | lm-sys fastchat Worker API Endpoint api_generate resource consumption
https://vuldb.com/vuln/358242
Signature, Permissions Required signature permissions-required
VDB-358242 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/358242/cti
Third Party Advisory third-party-advisory
Submit #792227 | LM-Sys FastChat <= 0.2.36 Denial of Service (CWE-400)
https://vuldb.com/submit/792227
Issue Tracking issue-tracking
https://github.com/lm-sys/FastChat/issues/3833

Scores

CVSS v3 5.3
EPSS 0.0062
EPSS Percentile 44.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-400 CWE-404
Status published
Products (38)
lm-sys/fastchat 0.2.0
lm-sys/fastchat 0.2.1
lm-sys/fastchat 0.2.10
lm-sys/fastchat 0.2.11
lm-sys/fastchat 0.2.12
lm-sys/fastchat 0.2.13
lm-sys/fastchat 0.2.14
lm-sys/fastchat 0.2.15
lm-sys/fastchat 0.2.16
lm-sys/fastchat 0.2.17
... and 28 more
Published Apr 20, 2026
Tracked Since Apr 20, 2026