What is CVE-2024-11603?

CVE-2024-11603 is a high-severity vulnerability in Lm-Sys Fastchat, classified under Server-Side Request Forgery (SSRF). CVSS score: 7.5/10. Published 2025-03-20.

How severe is CVE-2024-11603?

High severity. CVSS v3 base score is 7.5 out of 10.

SSRF in Lm-Sys Fastchat

CVE-2024-11603

A Server-Side Request Forgery (SSRF) vulnerability exists in lm-sys/fastchat version 0.2.36. The vulnerability is present in the `/queue/join?` endpoint, where insufficient validation of the path parameter allows an attacker to send crafted requests. This can lead to unauthorized access to internal networks or the AWS metadata endpoint, potentially exposing sensitive data and compromising internal servers.

Vulnerability class: SSRF (Server-Side Request Forgery)

EPSS: 0.006 (47.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Lm-sys Fastchat — versions 0.2.36
Lm-sys Lm-sys/fastchat — versions unspecified

Weakness classification (CWE)

CWE-918 — Server-Side Request Forgery (SSRF)

References

security@huntr.dev (Exploit, Third Party Advisory)

Frequently asked questions

What is CVE-2024-11603?: CVE-2024-11603 is a high-severity vulnerability in Lm-Sys Fastchat, classified under Server-Side Request Forgery (SSRF). CVSS score: 7.5/10. Published 2025-03-20.
How severe is CVE-2024-11603?: High severity. CVSS v3 base score is 7.5 out of 10.