CVE-2024-10907 - CVE House
Back to Database
Status published High CVE-2024-10907

Denial of Service (DoS) via Multipart Boundary in lm-sys/fastchat

Vulnerability Description

In lm-sys/fastchat Release v0.2.36, the server fails to handle excessive characters appended to the end of multipart boundaries. This flaw can be exploited by sending malformed multipart requests with arbitrary characters at the end of the boundary. Each extra character is processed in an infinite loop, leading to excessive resource consumption and a complete denial of service (DoS) for all users. The vulnerability is unauthenticated, meaning no user login or interaction is required for an attacker to exploit this issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-10907

Credits & Attribution

No credits recorded in the NVD database.

References

More from lm-sys

View All →
CVE-2025-3677
lm-sys fastchat apply_delta.py apply_delta_low_cpu_mem deserialization
Medium 4.8
CVE-2024-12376
Server Side Request Forgery in lm-sys/fastchat
High 7.5
CVE-2024-11603
Server-Side Request Forgery in lm-sys/fastchat
High 7.5
CVE-2024-10912
Denial of Service in lm-sys/fastchat
High 7.5
CVE-2024-10908
Open Redirect in lm-sys/fastchat
Medium 6.1

Affected Vendor

Affected Software

lm-sys/fastchat
Vulnerable Versions:
unspecified

Timeline

Official Publish: March 20th, 2025
Last Modified: October 15th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-835

MITRE ATT&CK TTPs

T1499 Endpoint Denial of Service
Impact
T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1562 Impair Defenses
Defense Evasion
T1485 Data Destruction
Impact