{"id":"CVE-2026-6607","summary":"lm-sys fastchat Worker API Endpoint api_generate resource consumption","details":"A security vulnerability has been detected in lm-sys fastchat up to 0.2.36. This issue affects the function api_generate of the component Worker API Endpoint. The manipulation leads to resource consumption. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The identifier of the patch is c9e84b89c91d45191dc24466888de526fa04cf33. It is suggested to install a patch to address this issue. Commit ff66426 patched this issue in api_generate of base_model_worker.py and did miss other entry points.","aliases":["GHSA-5h65-jx66-j7p5","PYSEC-2026-2484"],"modified":"2026-10-28T02:30:59.797048286Z","published":"2026-04-20T05:00:23.135Z","database_specific":{"cna_assigner":"VulDB","cwe_ids":["CWE-400","CWE-404"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/6xxx/CVE-2026-6607.json","unresolved_ranges":[{"extracted_events":[{"range":[{"introduced":"0.2.0"},{"last_affected":"0.2.0"},{"introduced":"0.2.2"},{"last_affected":"0.2.2"},{"introduced":"0.2.4"},{"last_affected":"0.2.4"},{"introduced":"0.2.6"},{"last_affected":"0.2.6"},{"introduced":"0.2.7"},{"last_affected":"0.2.7"},{"introduced":"0.2.8"},{"last_affected":"0.2.8"},{"introduced":"0.2.10"},{"last_affected":"0.2.10"},{"introduced":"0.2.11"},{"last_affected":"0.2.11"},{"introduced":"0.2.12"},{"last_affected":"0.2.12"},{"introduced":"0.2.13"},{"last_affected":"0.2.13"},{"introduced":"0.2.15"},{"last_affected":"0.2.15"},{"introduced":"0.2.16"},{"last_affected":"0.2.16"},{"introduced":"0.2.17"},{"last_affected":"0.2.17"},{"introduced":"0.2.19"},{"last_affected":"0.2.19"},{"introduced":"0.2.20"},{"last_affected":"0.2.20"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"}]}]},"references":[{"type":"WEB","url":"https://github.com/lm-sys/FastChat/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/6xxx/CVE-2026-6607.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6607"},{"type":"ADVISORY","url":"https://vuldb.com/submit/792227"},{"type":"ADVISORY","url":"https://vuldb.com/vuln/358242"},{"type":"REPORT","url":"https://github.com/lm-sys/FastChat/issues/3833"},{"type":"REPORT","url":"https://vuldb.com/vuln/358242/cti"},{"type":"FIX","url":"https://github.com/lm-sys/FastChat/commit/c9e84b89c91d45191dc24466888de526fa04cf33"},{"type":"FIX","url":"https://github.com/lm-sys/FastChat/pull/3835"},{"type":"EVIDENCE","url":"https://gist.github.com/YLChen-007/87216a2d97a882d619e11dc67cd473b5"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/lm-sys/fastchat","events":[{"introduced":"074f0b18155a81158dacbcba7db68807d14cb471"},{"fixed":"c9e84b89c91d45191dc24466888de526fa04cf33"}],"database_specific":{"extracted_events":[{"strategy":"StandaloneSingleVersion","range":[{"introduced":"0.2.1"},{"last_affected":"0.2.1"}],"source":"AFFECTED_FIELD"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"0.2.3"},{"last_affected":"0.2.3"}],"source":"AFFECTED_FIELD"},{"range":[{"introduced":"0.2.5"},{"last_affected":"0.2.5"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"range":[{"introduced":"0.2.9"},{"last_affected":"0.2.9"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"0.2.14"},{"last_affected":"0.2.14"}]},{"range":[{"introduced":"0.2.18"},{"last_affected":"0.2.18"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"0.2.21"},{"last_affected":"0.2.21"}]},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"0.2.22"},{"last_affected":"0.2.22"}],"source":"AFFECTED_FIELD"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"0.2.23"},{"last_affected":"0.2.23"}],"source":"AFFECTED_FIELD"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"0.2.24"},{"last_affected":"0.2.24"}],"source":"AFFECTED_FIELD"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"0.2.25"},{"last_affected":"0.2.25"}]},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"0.2.26"},{"last_affected":"0.2.26"}],"source":"AFFECTED_FIELD"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"0.2.27"},{"last_affected":"0.2.27"}]},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"0.2.28"},{"last_affected":"0.2.28"}],"source":"AFFECTED_FIELD"},{"range":[{"introduced":"0.2.29"},{"last_affected":"0.2.29"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"0.2.30"},{"last_affected":"0.2.30"}]},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"0.2.31"},{"last_affected":"0.2.31"}],"source":"AFFECTED_FIELD"},{"range":[{"introduced":"0.2.32"},{"last_affected":"0.2.32"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"range":[{"introduced":"0.2.33"},{"last_affected":"0.2.33"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"0.2.34"},{"last_affected":"0.2.34"}],"source":"AFFECTED_FIELD"},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"0.2.35"},{"last_affected":"0.2.35"}]},{"range":[{"introduced":"0.2.36"},{"last_affected":"0.2.36"}],"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion"},{"range":[{"fixed":"c9e84b89c91d45191dc24466888de526fa04cf33"}],"source":"REFERENCES_COMMIT"}]}}],"versions":["0.2.1","0.2.14","0.2.18","0.2.21","0.2.22","0.2.23","0.2.24","0.2.25","0.2.26","0.2.27","0.2.28","0.2.29","0.2.3","0.2.30","0.2.31","0.2.32","0.2.33","0.2.34","0.2.35","0.2.36","0.2.5","0.2.9"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-6607.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P"}]}