GHSA-qg86-f892-m4hj

Suggest an improvement
Source
https://github.com/advisories/GHSA-qg86-f892-m4hj
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-qg86-f892-m4hj/GHSA-qg86-f892-m4hj.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-qg86-f892-m4hj
Aliases
  • CVE-2024-10907
Published
2025-03-20T12:32:41Z
Modified
2025-10-15T20:00:10.131211Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
FastChat Uncontrolled Resource Consumption vulnerability
Details

In lm-sys/fastchat Release v0.2.36, the server fails to handle excessive characters appended to the end of multipart boundaries. This flaw can be exploited by sending malformed multipart requests with arbitrary characters at the end of the boundary. Each extra character is processed in an infinite loop, leading to excessive resource consumption and a complete denial of service (DoS) for all users. The vulnerability is unauthenticated, meaning no user login or interaction is required for an attacker to exploit this issue.

Database specific 
{
    "nvd_published_at": "2025-03-20T10:15:21Z",
    "cwe_ids": [
        "CWE-400",
        "CWE-835"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-03-21T16:37:30Z",
    "severity": "HIGH"
}
References

Affected packages

PyPI / fschat

Package

Name
fschat
View open source insights on deps.dev
Purl
pkg:pypi/fschat

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Last affected
0.2.36

Affected versions

0.*
0.1.1
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
0.1.9
0.1.10
0.2.0
0.2.1
0.2.2
0.2.3
0.2.4
0.2.5
0.2.6
0.2.7
0.2.8
0.2.9
0.2.10
0.2.11
0.2.12
0.2.13
0.2.14
0.2.15
0.2.16
0.2.17
0.2.18
0.2.20
0.2.21
0.2.23
0.2.24
0.2.26
0.2.27
0.2.28
0.2.29
0.2.30
0.2.31
0.2.32
0.2.33
0.2.34
0.2.35
0.2.36

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-qg86-f892-m4hj/GHSA-qg86-f892-m4hj.json"