AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

FastChatGHSA-h254-g997-685c

FastChat Server-Side Request Forgery vulnerability

FastChat

CVE-2024-11603 · Published Mar 20, 2025 · updated Jul 7, 2026

High7.5
No fix yet
GitHub advisory

A Server-Side Request Forgery (SSRF) vulnerability exists in lm-sys/fastchat version 0.2.36. The vulnerability is present in the /queue/join? endpoint, where insufficient validation of the path parameter allows an attacker to send crafted requests. This can lead to unauthorized access to internal networks or the AWS metadata endpoint, potentially exposing sensitive data and compromising internal servers.

Affected versions

PackageAffectedFixed in
fschat
PyPI
<= 0.2.36No fix yet
Details and references
CVSS 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-918
Also known as
CVE-2024-11603, PYSEC-2026-1397

More FastChat advisories

All FastChat
Medium 5.3Apr 20FastChat has a Content Moderation Bypass via Arena Side-by-Side ViewsCVE-2026-6608no fix yetMedium 5.3Apr 20FastChat has Denial of Service Through Blocking Event Loop in Model Workers (Incomplete Fix for ff66426)CVE-2026-6607no fix yetHigh 7.5Mar 20, 2025FastChat Server-Side Request Forgery vulnerabilityCVE-2024-12376no fix yetMedium 6.1Mar 20, 2025FastChat open redirect vulnerabilityCVE-2024-10908no fix yetHigh 7.5Mar 20, 2025FastChat Denial of Service vulnerabilityCVE-2024-10912no fix yetHigh 7.5Mar 20, 2025FastChat Uncontrolled Resource Consumption vulnerabilityCVE-2024-10907no fix yet