Denial of Service Vulnerability in FastChat by lm-sys

CVE-2024-10907

What is CVE-2024-10907?

A resource consumption vulnerability exists in FastChat version 0.2.36 due to improper handling of excessive characters appended to multipart boundaries. Attackers can exploit this flaw by sending malformed multipart requests with arbitrary characters at the boundary's end, which results in an infinite loop. This condition leads to overwhelming server resources, ultimately causing a denial of service to all users without any user authentication or interaction needed.

References