CVE-2026-6607

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-6607", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-04-19T15:59:39.594Z", "datePublished": "2026-04-20T05:00:23.135Z", "dateUpdated": "2026-04-20T11:37:05.103Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-20T05:00:23.135Z"}, "title": "lm-sys fastchat Worker API Endpoint api_generate resource consumption", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-400", "lang": "en", "description": "Resource Consumption"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-404", "lang": "en", "description": "Denial of Service"}]}], "affected": [{"vendor": "lm-sys", "product": "fastchat", "versions": [{"version": "0.2.0", "status": "affected"}, {"version": "0.2.1", "status": "affected"}, {"version": "0.2.2", "status": "affected"}, {"version": "0.2.3", "status": "affected"}, {"version": "0.2.4", "status": "affected"}, {"version": "0.2.5", "status": "affected"}, {"version": "0.2.6", "status": "affected"}, {"version": "0.2.7", "status": "affected"}, {"version": "0.2.8", "status": "affected"}, {"version": "0.2.9", "status": "affected"}, {"version": "0.2.10", "status": "affected"}, {"version": "0.2.11", "status": "affected"}, {"version": "0.2.12", "status": "affected"}, {"version": "0.2.13", "status": "affected"}, {"version": "0.2.14", "status": "affected"}, {"version": "0.2.15", "status": "affected"}, {"version": "0.2.16", "status": "affected"}, {"version": "0.2.17", "status": "affected"}, {"version": "0.2.18", "status": "affected"}, {"version": "0.2.19", "status": "affected"}, {"version": "0.2.20", "status": "affected"}, {"version": "0.2.21", "status": "affected"}, {"version": "0.2.22", "status": "affected"}, {"version": "0.2.23", "status": "affected"}, {"version": "0.2.24", "status": "affected"}, {"version": "0.2.25", "status": "affected"}, {"version": "0.2.26", "status": "affected"}, {"version": "0.2.27", "status": "affected"}, {"version": "0.2.28", "status": "affected"}, {"version": "0.2.29", "status": "affected"}, {"version": "0.2.30", "status": "affected"}, {"version": "0.2.31", "status": "affected"}, {"version": "0.2.32", "status": "affected"}, {"version": "0.2.33", "status": "affected"}, {"version": "0.2.34", "status": "affected"}, {"version": "0.2.35", "status": "affected"}, {"version": "0.2.36", "status": "affected"}], "cpes": ["cpe:2.3:a:lm-sys:fastchat:*:*:*:*:*:*:*:*"], "modules": ["Worker API Endpoint"]}], "descriptions": [{"lang": "en", "value": "A security vulnerability has been detected in lm-sys fastchat up to 0.2.36. This issue affects the function api_generate of the component Worker API Endpoint. The manipulation leads to resource consumption. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The identifier of the patch is c9e84b89c91d45191dc24466888de526fa04cf33. It is suggested to install a patch to address this issue. Commit ff66426 patched this issue in api_generate of base_model_worker.py and did miss other entry points."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:OF/RC:C"}}], "timeline": [{"time": "2026-04-19T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-04-19T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-04-19T18:04:48.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Eric-f (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/vuln/358242", "name": "VDB-358242 | lm-sys fastchat Worker API Endpoint api_generate resource consumption", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/358242/cti", "name": "VDB-358242 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/792227", "name": "Submit #792227 | LM-Sys FastChat <= 0.2.36 Denial of Service (CWE-400)", "tags": ["third-party-advisory"]}, {"url": "https://github.com/lm-sys/FastChat/issues/3833", "tags": ["issue-tracking"]}, {"url": "https://github.com/lm-sys/FastChat/pull/3835", "tags": ["issue-tracking", "patch"]}, {"url": "https://gist.github.com/YLChen-007/87216a2d97a882d619e11dc67cd473b5", "tags": ["exploit"]}, {"url": "https://github.com/lm-sys/FastChat/commit/c9e84b89c91d45191dc24466888de526fa04cf33", "tags": ["patch"]}, {"url": "https://github.com/lm-sys/FastChat/", "tags": ["product"]}], "tags": ["x_open-source"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-20T11:36:33.963840Z", "id": "CVE-2026-6607", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-20T11:37:05.103Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-6607", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-20T11:36:33.963840Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-20T11:36:53.115Z"}}], "cna": {"tags": ["x_open-source"], "title": "lm-sys fastchat Worker API Endpoint api_generate resource consumption", "credits": [{"lang": "en", "type": "reporter", "value": "Eric-f (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:OF/RC:C"}}], "affected": [{"cpes": ["cpe:2.3:a:lm-sys:fastchat:*:*:*:*:*:*:*:*"], "vendor": "lm-sys", "modules": ["Worker API Endpoint"], "product": "fastchat", "versions": [{"status": "affected", "version": "0.2.0"}, {"status": "affected", "version": "0.2.1"}, {"status": "affected", "version": "0.2.2"}, {"status": "affected", "version": "0.2.3"}, {"status": "affected", "version": "0.2.4"}, {"status": "affected", "version": "0.2.5"}, {"status": "affected", "version": "0.2.6"}, {"status": "affected", "version": "0.2.7"}, {"status": "affected", "version": "0.2.8"}, {"status": "affected", "version": "0.2.9"}, {"status": "affected", "version": "0.2.10"}, {"status": "affected", "version": "0.2.11"}, {"status": "affected", "version": "0.2.12"}, {"status": "affected", "version": "0.2.13"}, {"status": "affected", "version": "0.2.14"}, {"status": "affected", "version": "0.2.15"}, {"status": "affected", "version": "0.2.16"}, {"status": "affected", "version": "0.2.17"}, {"status": "affected", "version": "0.2.18"}, {"status": "affected", "version": "0.2.19"}, {"status": "affected", "version": "0.2.20"}, {"status": "affected", "version": "0.2.21"}, {"status": "affected", "version": "0.2.22"}, {"status": "affected", "version": "0.2.23"}, {"status": "affected", "version": "0.2.24"}, {"status": "affected", "version": "0.2.25"}, {"status": "affected", "version": "0.2.26"}, {"status": "affected", "version": "0.2.27"}, {"status": "affected", "version": "0.2.28"}, {"status": "affected", "version": "0.2.29"}, {"status": "affected", "version": "0.2.30"}, {"status": "affected", "version": "0.2.31"}, {"status": "affected", "version": "0.2.32"}, {"status": "affected", "version": "0.2.33"}, {"status": "affected", "version": "0.2.34"}, {"status": "affected", "version": "0.2.35"}, {"status": "affected", "version": "0.2.36"}]}], "timeline": [{"lang": "en", "time": "2026-04-19T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-04-19T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-04-19T18:04:48.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/358242", "name": "VDB-358242 | lm-sys fastchat Worker API Endpoint api_generate resource consumption", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/358242/cti", "name": "VDB-358242 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/792227", "name": "Submit #792227 | LM-Sys FastChat <= 0.2.36 Denial of Service (CWE-400)", "tags": ["third-party-advisory"]}, {"url": "https://github.com/lm-sys/FastChat/issues/3833", "tags": ["issue-tracking"]}, {"url": "https://github.com/lm-sys/FastChat/pull/3835", "tags": ["issue-tracking", "patch"]}, {"url": "https://gist.github.com/YLChen-007/87216a2d97a882d619e11dc67cd473b5", "tags": ["exploit"]}, {"url": "https://github.com/lm-sys/FastChat/commit/c9e84b89c91d45191dc24466888de526fa04cf33", "tags": ["patch"]}, {"url": "https://github.com/lm-sys/FastChat/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A security vulnerability has been detected in lm-sys fastchat up to 0.2.36. This issue affects the function api_generate of the component Worker API Endpoint. The manipulation leads to resource consumption. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The identifier of the patch is c9e84b89c91d45191dc24466888de526fa04cf33. It is suggested to install a patch to address this issue. Commit ff66426 patched this issue in api_generate of base_model_worker.py and did miss other entry points."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "Resource Consumption"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-404", "description": "Denial of Service"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-20T05:00:23.135Z"}}}, "cveMetadata": {"cveId": "CVE-2026-6607", "state": "PUBLISHED", "dateUpdated": "2026-04-20T11:37:05.103Z", "dateReserved": "2026-04-19T15:59:39.594Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-04-20T05:00:23.135Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:lm-sys:fastchat:*:*:*:*:*:*:*:*"], "modules": ["Worker API Endpoint"], "product": "fastchat", "vendor": "lm-sys", "versions": [{"status": "affected", "version": "0.2.0"}, {"status": "affected", "version": "0.2.1"}, {"status": "affected", "version": "0.2.2"}, {"status": "affected", "version": "0.2.3"}, {"status": "affected", "version": "0.2.4"}, {"status": "affected", "version": "0.2.5"}, {"status": "affected", "version": "0.2.6"}, {"status": "affected", "version": "0.2.7"}, {"status": "affected", "version": "0.2.8"}, {"status": "affected", "version": "0.2.9"}, {"status": "affected", "version": "0.2.10"}, {"status": "affected", "version": "0.2.11"}, {"status": "affected", "version": "0.2.12"}, {"status": "affected", "version": "0.2.13"}, {"status": "affected", "version": "0.2.14"}, {"status": "affected", "version": "0.2.15"}, {"status": "affected", "version": "0.2.16"}, {"status": "affected", "version": "0.2.17"}, {"status": "affected", "version": "0.2.18"}, {"status": "affected", "version": "0.2.19"}, {"status": "affected", "version": "0.2.20"}, {"status": "affected", "version": "0.2.21"}, {"status": "affected", "version": "0.2.22"}, {"status": "affected", "version": "0.2.23"}, {"status": "affected", "version": "0.2.24"}, {"status": "affected", "version": "0.2.25"}, {"status": "affected", "version": "0.2.26"}, {"status": "affected", "version": "0.2.27"}, {"status": "affected", "version": "0.2.28"}, {"status": "affected", "version": "0.2.29"}, {"status": "affected", "version": "0.2.30"}, {"status": "affected", "version": "0.2.31"}, {"status": "affected", "version": "0.2.32"}, {"status": "affected", "version": "0.2.33"}, {"status": "affected", "version": "0.2.34"}, {"status": "affected", "version": "0.2.35"}, {"status": "affected", "version": "0.2.36"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A security vulnerability has been detected in lm-sys fastchat up to 0.2.36. This issue affects the function api_generate of the component Worker API Endpoint. The manipulation leads to resource consumption. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The identifier of the patch is c9e84b89c91d45191dc24466888de526fa04cf33. It is suggested to install a patch to address this issue. Commit ff66426 patched this issue in api_generate of base_model_worker.py and did miss other entry points."}, {"lang": "es", "value": "Una vulnerabilidad de seguridad ha sido detectada en lm-sys fastchat hasta 0.2.36. Este problema afecta la funci\u00f3n api_generate del componente Worker API Endpoint. La manipulaci\u00f3n conduce a consumo de recursos. El ataque puede ser iniciado remotamente. El exploit ha sido divulgado p\u00fablicamente y puede ser utilizado. El identificador del parche es c9e84b89c91d45191dc24466888de526fa04cf33. Se sugiere instalar un parche para abordar este problema. El commit ff66426 parche\u00f3 este problema en api_generate de base_model_worker.py y omiti\u00f3 otros puntos de entrada."}], "id": "CVE-2026-6607", "lastModified": "2026-10-26T22:10:00.163", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-6607", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-20T11:36:33.963840Z", "version": "2.0.3"}}]}, "published": "2026-04-20T05:16:16.190", "references": [{"source": "cna@vuldb.com", "url": "https://gist.github.com/YLChen-007/87216a2d97a882d619e11dc67cd473b5"}, {"source": "cna@vuldb.com", "url": "https://github.com/lm-sys/FastChat/"}, {"source": "cna@vuldb.com", "url": "https://github.com/lm-sys/FastChat/commit/c9e84b89c91d45191dc24466888de526fa04cf33"}, {"source": "cna@vuldb.com", "url": "https://github.com/lm-sys/FastChat/issues/3833"}, {"source": "cna@vuldb.com", "url": "https://github.com/lm-sys/FastChat/pull/3835"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/792227"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/358242"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/358242/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-404"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.2.0,0.2.36]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "fastchat", "source": "cna", "vendor": "lm-sys"}, "product": "fastchat", "vendor": "lm-sys"}], "analysis": {"en": {"generated_at": "2026-04-20T06:50:33.313388+00:00", "value": {"mitigation_remediation": ["Update FastChat to a release that includes the c9e84b89c commit, which resolves the resource exhaustion flaw in the Worker API Endpoint (CWE\u2011400).", "Conduct a brief audit of other Worker API endpoints for unbounded loops or resource allocation that could trigger CWE\u2011404, and apply fixes or add defensive limits.", "If an update is not immediately available, isolate the Worker API Endpoint behind network segmentation or require authentication and set hard request limits to prevent excessive resource usage."], "summary": {"action": "Apply Patch", "impact": "Remote Denial of Service via Resource Exhaustion"}, "threat_synthesis": {"affected_systems": "All installations of lm-sys FastChat up to and including version 0.2.36 are susceptible. The issue resides in the Worker API Endpoint api_generate function, defined in base_model_worker.py. No newer releases publicly identify a fix for this specific path, so any deployment of the affected version must be updated.", "description_and_impact": "Affecting the api_generate function in lm-sys FastChat, the vulnerability allows a remote attacker to cause excessive resource consumption by submitting crafted requests. The flaw arises from insufficient input validation or rate limiting within the Worker API Endpoint, leading to uncontrolled memory or CPU usage, which can degrade service availability for legitimate users.", "risk_and_exploitability": "The CVSS score of 6.9 places the flaw in the medium severity range. Although its EPSS score is not publicly available, the vulnerability has been demonstrated publicly and can be triggered remotely without local access. It is not listed in CISA\u2019s KEV catalog, but the remote nature and confirmed exploit suggest a realistic attack vector. The commit that patches api_generate in base_model_worker.py (c9e84b89) addresses this path, yet a separate commit (ff66426) noted that other entry points may remain unpatched, potentially extending the risk."}}}}, "created": "2026-04-20T06:30:45.089913+00:00", "updated": "2026-04-20T07:00:11.080000+00:00", "vendors": ["lm-sys", "lm-sys$PRODUCT$fastchat"]}