CVE-2024-10044: A Server-Side Request Forgery (SSRF) vulnerability exists in the POST /worker_generate_stream API endpoint of

This week

CRITICAL 9.3REMOTEDOWNGRADE

CVE-2024-10044 is a critical-severity flaw (CVSS 9.3) affecting fastchat. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

A Server-Side Request Forgery (SSRF) vulnerability exists in the POST /worker_generate_stream API endpoint of the Controller API Server in lm-sys/fastchat, as of commit e208d5677c6837d590b81cb03847c0b9de100765. This vulnerability allows attackers to exploit the victim controller API server's credentials to perform unauthorized web actions or access unauthorized web resources by combining it with the POST /register_worker endpoint.

Why this priority

Critical severity
Public exploit reference
Remotely exploitable, no login, no user action

No fix is published yet: follow the downgrade or mitigation steps.

Risk facts

CVSS score	9.3 (Critical)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	0.5% (top 55%)
CISA exploited list	No
Weakness	CWE-918
Published	2024-12-30
Last modified	2026-06-17

Publisher (CNA): huntr.dev · Vendor: lm-sys

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2024-12-30 12:15 UTCPublished CVE record published
2026-06-17 06:54 UTCUpdated Record last modified

lm-sys fastchat DOWNGRADE

Affected: 2024-09-23

Fixed in: no fixed release known

Safe to downgrade to: a release before 2024-09-23

1. Check installed version

apt-cache policy fastchat || rpm -q fastchat || fastchat --version

2. No fixed release: DOWNGRADE to a release before 2024-09-23 (Debian / Ubuntu)

apt-cache madison fastchat sudo apt install fastchat=<VERSION_BEFORE_2024-09-23> sudo apt-mark hold fastchat

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list fastchat sudo dnf downgrade fastchat-<VERSION_BEFORE_2024-09-23> sudo dnf versionlock add fastchat

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2024-10044?

fastchat: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2024-10044 being exploited?

CVE-2024-10044 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2024-10044 affect?

CVE-2024-10044 affects fastchat. Severity is critical (CVSS 9.3). A Server-Side Request Forgery (SSRF) vulnerability exists in the POST /worker_generate_stream API endpoint of the Controller API Server in lm-sys/fastchat, as of commit e208d5677c6837d590b81cb03847c0b9de100765. This vulnerability allows att

How urgent is CVE-2024-10044?

Priority 54/100. Critical severity; Public exploit reference; Remotely exploitable, no login, no user action

Related CVEs

CVE-2024-12376 HIGH 7.5 DOWNGRADE A Server-Side Request Forgery (SSRF) vulnerability was identified in the lm-sys/fastchat web server, specifica
CVE-2024-11603 HIGH 7.5 DOWNGRADE A Server-Side Request Forgery (SSRF) vulnerability exists in lm-sys/fastchat version 0.2.36
CVE-2024-10912 HIGH 7.5 DOWNGRADE A Denial of Service (DoS) vulnerability exists in the file upload feature of lm-sys/fastchat version 0.2.36
CVE-2024-10908 MEDIUM 6.1 DOWNGRADE An open redirect vulnerability in lm-sys/fastchat Release v0.2.36 allows a remote unauthenticated attacker to
CVE-2024-10907 HIGH 7.5 DOWNGRADE In lm-sys/fastchat Release v0.2.36, the server fails to handle excessive characters appended to the end of mul

References

← Back to latest CVEs