CVE-2024-10912

Advisory

Affected versions of the lm-sys FastChat package are vulnerable to Denial of Service (DoS). The file upload feature fails to properly validate the length of filenames in multipart form-data requests, leading to server resource exhaustion. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted HTTP request with an excessively large filename in the form-data boundary, resulting in the server becoming overwhelmed and unavailable to legitimate users.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/advisories/GHSA-79rp-v9rm-gxm8
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-10912