Lm-Sys Fastchat
9 CVEs affecting Lm-Sys Fastchat. Latest disclosed: 2026-04-20. Critical: 1, High: 4.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-10044 | Critical | 9.3 | 2024-12-30 | A Server-Side Request Forgery (SSRF) vulnerability exists in the POST /worker_generate_stream API endpoint of the Controller API Server in lm-sys/fastchat, as… |
CVE-2024-12376 | High | 7.5 | 2025-03-20 | A Server-Side Request Forgery (SSRF) vulnerability was identified in the lm-sys/fastchat web server, specifically in the affected version git 2c68a13. This vul… |
CVE-2024-11603 | High | 7.5 | 2025-03-20 | A Server-Side Request Forgery (SSRF) vulnerability exists in lm-sys/fastchat version 0.2.36. The vulnerability is present in the `/queue/join?` endpoint, where… |
CVE-2024-10912 | High | 7.5 | 2025-03-20 | A Denial of Service (DoS) vulnerability exists in the file upload feature of lm-sys/fastchat version 0.2.36. The vulnerability is due to improper handling of f… |
CVE-2024-10907 | High | 7.5 | 2025-03-20 | In lm-sys/fastchat Release v0.2.36, the server fails to handle excessive characters appended to the end of multipart boundaries. This flaw can be exploited by… |
CVE-2024-10908 | Medium | 6.1 | 2025-03-20 | An open redirect vulnerability in lm-sys/fastchat Release v0.2.36 allows a remote unauthenticated attacker to redirect users to arbitrary websites via a specia… |
CVE-2026-6608 | Medium | 5.3 | 2026-04-20 | A vulnerability was detected in lm-sys fastchat up to 0.2.36. Impacted is the function add_text of the component Arena Side-by-Side View Handler. The manipulat… |
CVE-2026-6607 | Medium | 5.3 | 2026-04-20 | A security vulnerability has been detected in lm-sys fastchat up to 0.2.36. This issue affects the function api_generate of the component Worker API Endpoint… |
CVE-2025-3677 | Medium | 5.3 | 2025-04-16 | A vulnerability classified as critical was found in lm-sys fastchat up to 0.2.36. This vulnerability affects the function split_files/apply_delta_low_cpu_mem o… |