CVE-2024-10907: Lm-sys Fastchat DoS Vulnerability

CVE-2024-10907 Overview

CVE-2024-10907 affects lm-sys/fastchat release v0.2.36, an open-source platform for training and serving large language model (LLM) chatbots. The server fails to properly handle excessive characters appended to multipart boundary strings. An attacker can send malformed multipart HTTP requests containing arbitrary characters after the boundary. Each extra character is processed in an infinite loop [CWE-835], exhausting server resources. This results in a complete denial of service (DoS) affecting all users of the FastChat instance.

Critical Impact
Unauthenticated attackers can remotely trigger an infinite loop in the multipart parser, causing full service disruption of FastChat LLM serving infrastructure without any user interaction.

Affected Products

lm-sys FastChat version 0.2.36
FastChat OpenAI-compatible API server components
Deployments serving multipart HTTP endpoints

Discovery Timeline

2025-03-20 - CVE-2024-10907 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10907

Vulnerability Analysis

The vulnerability is a resource exhaustion flaw categorized as CWE-835: Loop with Unreachable Exit Condition (Infinite Loop). FastChat's HTTP request handler processes multipart form data by parsing the boundary delimiter defined in the Content-Type header. The parser does not enforce length or character constraints on data trailing the boundary token. When arbitrary characters are appended, the parsing routine enters a loop that iterates over each additional character without a valid termination condition. Attackers exploit this over the network with a single crafted HTTP request. The FastChat process consumes CPU cycles until the service becomes unresponsive to legitimate users.

Root Cause

The root cause is missing input validation on the multipart boundary parameter. The parser assumes well-formed boundary strings and lacks bounds checking on trailing content. Each appended character extends the loop iteration count, and no upper bound prevents runaway execution. This is a common pattern in HTTP parsers that trust client-supplied delimiter values without sanitization.

Attack Vector

The attack requires no authentication and no user interaction. An adversary sends an HTTP POST request with a Content-Type: multipart/form-data; boundary=<value><padding> header to any exposed FastChat endpoint accepting multipart uploads. The <padding> consists of arbitrary characters appended after a legitimate boundary. The FastChat parser enters the infinite loop while processing the request body, exhausting CPU resources. Because FastChat commonly serves LLM inference APIs, a successful attack disables the entire chatbot service.

No verified public exploit code is available. See the Huntr Bounty Listing for technical details from the original submission.

Detection Methods for CVE-2024-10907

Indicators of Compromise

HTTP requests with abnormally long Content-Type headers containing multipart boundary values followed by unusual character sequences
Sustained high CPU utilization on FastChat worker processes without corresponding legitimate traffic volume
FastChat API endpoints becoming unresponsive while the process remains active
Repeated POST requests from a single source IP to multipart-accepting endpoints

Detection Strategies

Inspect web application firewall (WAF) and reverse proxy logs for malformed multipart/form-data boundaries exceeding expected length
Monitor Python process CPU time per request on hosts running FastChat and alert on outliers
Deploy network intrusion detection signatures matching oversized boundary parameters in HTTP headers
Correlate 5xx error rates and request latency spikes on FastChat endpoints with source IP frequency

Monitoring Recommendations

Track FastChat process resource metrics (CPU, memory, thread count) with alerting thresholds for sustained saturation
Enable request timing telemetry in the reverse proxy layer to identify requests that never complete
Log full HTTP request headers for FastChat endpoints during incident investigation windows
Baseline normal Content-Type header lengths and alert on statistical deviations

How to Mitigate CVE-2024-10907

Immediate Actions Required

Upgrade lm-sys/fastchat beyond version 0.2.36 once a patched release is available from the upstream project
Place FastChat behind a reverse proxy or WAF that validates and limits Content-Type header length and multipart boundary format
Restrict network exposure of FastChat API endpoints to trusted clients using network access control lists
Implement per-source request rate limiting to reduce the impact of DoS attempts

Patch Information

No vendor advisory URL is listed in the NVD record for CVE-2024-10907. The vulnerability was reported through the Huntr bug bounty platform. Administrators should monitor the lm-sys/fastchat GitHub repository for release notes addressing the boundary parsing flaw and consult the Huntr Bounty Listing for remediation guidance.

Workarounds

Configure the upstream reverse proxy (nginx, HAProxy, or Envoy) to reject Content-Type headers exceeding a strict maximum length
Enforce request body size limits and connection timeouts at the proxy layer to bound processing time per request
Disable or restrict multipart endpoint access if the deployment does not require file upload functionality
Deploy FastChat workers with strict CPU quotas using cgroups or container resource limits to contain resource exhaustion

bash

# Example nginx configuration limiting request header size and timeouts
http {
    large_client_header_buffers 4 4k;
    client_header_timeout 10s;
    client_body_timeout 10s;
    client_max_body_size 8m;
    send_timeout 10s;

    server {
        listen 443 ssl;
        location /v1/ {
            proxy_pass http://fastchat_backend;
            proxy_read_timeout 15s;
            limit_req zone=fastchat_limit burst=20 nodelay;
        }
    }
}