How severe is CVE-2024-10907?

CVE-2024-10907 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.

Is CVE-2024-10907 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (46th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-10907?

CVE-2024-10907 affects Lm-sys Fastchat. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2024-10907?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

Does CVE-2024-10907 have an EU (EUVD) identifier?

Yes. CVE-2024-10907 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-7049.

When was CVE-2024-10907 published?

CVE-2024-10907 was published on 2025-03-20 and last updated on 2026-06-17.

CVE-2024-10907

CVE-2024-10907 is a high-severity vulnerability in Lm-sys Fastchat with a CVSS 3.x base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-835.

Key facts

Severity: High (CVSS 3.x base score 7.5)
EPSS exploit prediction: 1% (46th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-7049
Weakness: CWE-835
Affected product: Lm-sys Fastchat
Published: 2025-03-20
Last modified: 2026-06-17

Description

In lm-sys/fastchat Release v0.2.36, the server fails to handle excessive characters appended to the end of multipart boundaries. This flaw can be exploited by sending malformed multipart requests with arbitrary characters at the end of the boundary. Each extra character is processed in an infinite loop, leading to excessive resource consumption and a complete denial of service (DoS) for all users. The vulnerability is unauthenticated, meaning no user login or interaction is required for an attacker to exploit this issue.

Frequently asked questions

What is CVE-2024-10907?: In lm-sys/fastchat Release v0.2.36, the server fails to handle excessive characters appended to the end of multipart boundaries. This flaw can be exploited by sending malformed multipart requests with arbitrary characters at the end of the boundary. Each extra character is processed in an infinite loop, leading to excessive resource consumption and a complete denial of service (DoS) for all users. The vulnerability is unauthenticated, meaning no user login or interaction is required for an attacker to exploit this issue.
How severe is CVE-2024-10907?: CVE-2024-10907 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2024-10907 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (46th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-10907?: CVE-2024-10907 affects Lm-sys Fastchat. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2024-10907?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
Does CVE-2024-10907 have an EU (EUVD) identifier?: Yes. CVE-2024-10907 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-7049.
When was CVE-2024-10907 published?: CVE-2024-10907 was published on 2025-03-20 and last updated on 2026-06-17.

References

https://huntr.com/bounties/bf3ca81d-3508-4455-95d9-0b653e46d6e4

Affected products (1)

cpe:2.3:a:lm-sys:fastchat:0.2.36:*:*:*:*:*:*:*

More vulnerabilities in Lm-sys Fastchat

CVE-2024-10044 — Critical (CVSS 9.3): A Server-Side Request Forgery (SSRF) vulnerability exists in the POST /worker_generate_stream API endpoint of the…
CVE-2024-12376 — High (CVSS 7.5): A Server-Side Request Forgery (SSRF) vulnerability was identified in the lm-sys/fastchat web server, specifically in…
CVE-2024-11603 — High (CVSS 7.5): A Server-Side Request Forgery (SSRF) vulnerability exists in lm-sys/fastchat version 0.2.36. The vulnerability is…
CVE-2024-10912 — High (CVSS 7.5): A Denial of Service (DoS) vulnerability exists in the file upload feature of lm-sys/fastchat version 0.2.36. The…
CVE-2024-10908 — Medium (CVSS 6.1): An open redirect vulnerability in lm-sys/fastchat Release v0.2.36 allows a remote unauthenticated attacker to redirect…

All CVEs affecting Lm-sys Fastchat →

Other CWE-835 (Loop with Unreachable Exit Condition (Infinite Loop)) vulnerabilities

CVE-2026-24816 — Critical (CVSS 10.0): Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in datavane tis…
CVE-2018-20784 — Critical (CVSS 9.8): In the Linux kernel before 4.20.2, kernel/sched/fair.c mishandles leaf cfs_rq's, which allows attackers to cause a…
CVE-2017-12997 — Critical (CVSS 9.8): The LLDP parser in tcpdump before 4.9.2 could enter an infinite loop due to a bug in…
CVE-2017-12995 — Critical (CVSS 9.8): The DNS parser in tcpdump before 4.9.2 could enter an infinite loop due to a bug in print-domain.c:ns_print().
CVE-2017-12990 — Critical (CVSS 9.8): The ISAKMP parser in tcpdump before 4.9.2 could enter an infinite loop due to bugs in print-isakmp.c, several functions.
CVE-2026-31448 — Critical (CVSS 9.4): In the Linux kernel, the following vulnerability has been resolved: ext4: avoid infinite loops caused by residual…

Browse all CWE-835 (Loop with Unreachable Exit Condition (Infinite Loop)) vulnerabilities →