HIGH7.5

PYSEC-2026-1395

FastChat Denial of Service vulnerability

Details

A Denial of Service (DoS) vulnerability exists in the file upload feature of lm-sys/fastchat version 0.2.36. The vulnerability is due to improper handling of form-data with a large filename in the file upload request. An attacker can exploit this by sending a payload with an excessively large filename, causing the server to become overwhelmed and unavailable to legitimate users.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/fschat

Introduced in: 0

No fixed version published yet for fschat (pip). Pin to a known-safe version or switch to an alternative.

References

https://nvd.nist.gov/vuln/detail/CVE-2024-10912[ADVISORY]
https://github.com/lm-sys/FastChat[PACKAGE]
https://huntr.com/bounties/52f335b8-1134-4d0f-acb4-efef516de414[WEB]
https://pypi.org/project/fschat[PACKAGE]
https://github.com/advisories/GHSA-79rp-v9rm-gxm8[ADVISORY]