CVE-2024-10912 HIGH

CVE-2024-10912: Denial of Service in lm-sys/fastchat

Vendor Lm-Sys
Product lm-sys/fastchat
Weakness CWE-400
Published March 20, 2025
Last update March 20, 2025

CVSS base score

7.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

What the vulnerability does

01Description

A Denial of Service (DoS) vulnerability exists in the file upload feature of lm-sys/fastchat version 0.2.36. The vulnerability is due to improper handling of form-data with a large filename in the file upload request. An attacker can exploit this by sending a payload with an excessively large filename, causing the server to become overwhelmed and unavailable to legitimate users.

Key dates

02Disclosure timeline

March 20, 2025 CVE published
March 20, 2025 Record updated