PT-2025-12079 · Unknown · Lm-Sys/Fastchat

Published 2025-03-20 · Updated 2025-03-21 · CVE-2024-10912

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions lm-sys/fastchat version 0.2.36

Description A Denial of Service (DoS) issue exists in the file upload feature due to improper handling of form-data with a large filename in the file upload request. An attacker can exploit this by sending a payload with an excessively large filename, causing the server to become overwhelmed and unavailable to legitimate users.

Recommendations For version 0.2.36, consider restricting the size of filenames allowed in the file upload feature to prevent exploitation until a patch is available. As a temporary workaround, limiting the file upload feature's accessibility can also help minimize the risk of exploitation.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2024-10912

GHSA-79RP-V9RM-GXM8

Affected Products

Lm-Sys/Fastchat

References · 7

• 🔥 https://huntr.com/bounties/52f335b8-1134-4d0f-acb4-efef516de414 · Exploit
• https://osv.dev/vulnerability/GHSA-79rp-v9rm-gxm8 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-10912 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-10912 · Security Note
• https://github.com/lm-sys/FastChat · Note
• https://twitter.com/cybercronai/status/1903077338574897394 · Twitter Post
• https://twitter.com/CVEnew/status/1902671040955769215 · Twitter Post