CVE-2024-10907

Advisory

Affected versions of the FastChat package are vulnerable to Denial of Service through improper handling of multipart request boundaries. The server fails to validate excessive characters appended to multipart boundaries, causing an infinite loop processing for each extra character.

An unauthenticated remote attacker can exploit this vulnerability by sending malformed multipart requests with arbitrary characters at the end of the boundary, resulting in excessive CPU consumption and complete service unavailability for all users.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/advisories/GHSA-qg86-f892-m4hj
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-10907