lm-sys fastchat apply_delta.py apply_delta_low_cpu_mem deserialization

4.8 CVSS

Vulnerability Description

A vulnerability classified as critical was found in lm-sys fastchat up to 0.2.36. This vulnerability affects the function split_files/apply_delta_low_cpu_mem of the file fastchat/model/apply_delta.py. The manipulation leads to deserialization. An attack has to be approached locally.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-3677

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

ybdesire (VulDB User)
ybdesire (VulDB User)

References

More from lm-sys

View All →

CVE-2024-12376

Server Side Request Forgery in lm-sys/fastchat

High 7.5

CVE-2024-11603

Server-Side Request Forgery in lm-sys/fastchat

High 7.5

CVE-2024-10912

Denial of Service in lm-sys/fastchat

High 7.5

CVE-2024-10908

Open Redirect in lm-sys/fastchat

Medium 6.1

CVE-2024-10907

Denial of Service (DoS) via Multipart Boundary in lm-sys/fastchat

High 7.5

Affected Vendor

lm-sys

View all reports →

Affected Software

fastchat

Vulnerable Versions:

0.2.0, 0.2.1, 0.2.2, 0.2.3, 0.2.4, 0.2.5, 0.2.6, 0.2.7, 0.2.8, 0.2.9, 0.2.10, 0.2.11, 0.2.12, 0.2.13, 0.2.14, 0.2.15, 0.2.16, 0.2.17, 0.2.18, 0.2.19, 0.2.20, 0.2.21, 0.2.22, 0.2.23, 0.2.24, 0.2.25, 0.2.26, 0.2.27, 0.2.28, 0.2.29, 0.2.30, 0.2.31, 0.2.32, 0.2.33, 0.2.34, 0.2.35, 0.2.36