Skip to content
TrackCVE
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
Back

CVE-2026-6607

lm-sys fastchat Worker API Endpoint api_generate resource consumption

Medium6.9Public exploitEPSS 0.62%
Published
Updated
Reserved
Assigned by
VulDB

Description

A security vulnerability has been detected in lm-sys fastchat up to 0.2.36. This issue affects the function api_generate of the component Worker API Endpoint. The manipulation leads to resource consumption. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The identifier of the patch is c9e84b89c91d45191dc24466888de526fa04cf33. It is suggested to install a patch to address this issue. Commit ff66426 patched this issue in api_generate of base_model_worker.py and did miss other entry points.

Public exploit

A reference of the record is tagged as an exploit or proof of concept: anyone can try it against an unpatched system. CISA's SSVC rates its exploitation: a proof of concept is public.

Timeline

  1. ID reserved

    By VulDB

  2. · 1 day later

    Published

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2026-6607, by who scored it
Scored byCVSSScoreVector
VulDBCNA (assigner)4.0Medium6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
VulDBCNA (assigner)3.1Medium5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
VulDBCNA (assigner)3.0Medium5.3CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
VulDBCNA (assigner)2.0Medium5.0AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:OF/RC:C
NVDNVD · Deferred4.0Medium5.5CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS (exploitation in 30 days)
0.62% · top 50% of all CVEs (7 Nov 2026)
CISA SSVC
Exploitation: poc · Automatable: yes · Technical impact: partial
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.9.

Weakness

Affected products

  • lm-sys · fastchat

    • affected 0.2.0
    • affected 0.2.1
    • affected 0.2.2
    • affected 0.2.3
    • affected 0.2.4
    • affected 0.2.5
    • affected 0.2.6
    • affected 0.2.7
    • affected 0.2.8
    • affected 0.2.9
    • affected 0.2.10
    • affected 0.2.11
    • affected 0.2.12
    • affected 0.2.13
    • affected 0.2.14
    • affected 0.2.15
    • affected 0.2.16
    • affected 0.2.17
    • affected 0.2.18
    • affected 0.2.19
    • affected 0.2.20
    • affected 0.2.21
    • affected 0.2.22
    • affected 0.2.23
    • affected 0.2.24
    • affected 0.2.25
    • affected 0.2.26
    • affected 0.2.27
    • affected 0.2.28
    • affected 0.2.29
    • affected 0.2.30
    • affected 0.2.31
    • affected 0.2.32
    • affected 0.2.33
    • affected 0.2.34
    • affected 0.2.35
    • affected 0.2.36

Affected packages

From reviewed advisories of the GitHub Advisory Database.

References (8)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2026-6607 badge
[![CVE-2026-6607](https://trackcve.app/badge/CVE-2026-6607.svg)](https://trackcve.app/cve/CVE-2026-6607)

Record last updated .