CVE-2024-10907
Denial of Service (DoS) via Multipart Boundary in lm-sys/fastchat
- State
- Published
- Severity
- 7.5 High
- Published
- Mar 20, 2025
- Updated
- Oct 15, 2025
- Reserved
- Nov 5, 2024
Description
In lm-sys/fastchat Release v0.2.36, the server fails to handle excessive characters appended to the end of multipart boundaries. This flaw can be exploited by sending malformed multipart requests with arbitrary characters at the end of the boundary. Each extra character is processed in an infinite loop, leading to excessive resource consumption and a complete denial of service (DoS) for all users. The vulnerability is unauthenticated, meaning no user login or interaction is required for an attacker to exploit this issue.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.0 | 7.5 High | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | @huntr_ai |
Weaknesses
- CWE-835 Loop with Unreachable Exit Condition
Affected Products
| Product | Versions |
|---|---|
lm-sys/fastchatlm-sys |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.