A Denial of Service (DoS) vulnerability exists in the file upload feature of lm-sys/fastchat version 0.2.36. The vulnerability is due to improper handling of form-data with a large filename in the file upload request. An attacker can exploit this by sending a payload with an excessively large filename, causing the server to become overwhelmed and unavailable to legitimate users.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Lm-sys |
|
No data.
References
History
Thu, 31 Jul 2025 18:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Lm-sys
Lm-sys fastchat |
|
| CPEs | cpe:2.3:a:lm-sys:fastchat:0.2.36:*:*:*:*:*:*:* | |
| Vendors & Products |
Lm-sys
Lm-sys fastchat |
Thu, 20 Mar 2025 10:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A Denial of Service (DoS) vulnerability exists in the file upload feature of lm-sys/fastchat version 0.2.36. The vulnerability is due to improper handling of form-data with a large filename in the file upload request. An attacker can exploit this by sending a payload with an excessively large filename, causing the server to become overwhelmed and unavailable to legitimate users. | |
| Title | Denial of Service in lm-sys/fastchat | |
| Weaknesses | CWE-400 | |
| References |
| |
| Metrics |
cvssV3_0
|
MITRE
Status: PUBLISHED
Assigner: @huntr_ai
Published: 2025-03-20T10:10:59.830Z
Updated: 2025-03-20T18:14:28.739Z
Reserved: 2024-11-06T00:32:13.946Z
Link: CVE-2024-10912
Vulnrichment
No data.
NVD
Status : Analyzed
Published: 2025-03-20T10:15:21.607
Modified: 2025-07-31T17:48:28.750
Link: CVE-2024-10912
Redhat
No data.