PatchTheCVElm-sys vulnerabilities
Recent CVEs affecting lm-sys products. 6 tracked.
lm-sys has 6 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 0. Most recent: 2025-03-20. Highest priority: CVE-2024-10044 (score 54/100).
- CVE-2024-12376 HIGH 7.5 DOWNGRADE A Server-Side Request Forgery (SSRF) vulnerability was identified in the lm-sys/fastchat web server, specifica
- CVE-2024-11603 HIGH 7.5 DOWNGRADE A Server-Side Request Forgery (SSRF) vulnerability exists in lm-sys/fastchat version 0.2.36
- CVE-2024-10912 HIGH 7.5 DOWNGRADE A Denial of Service (DoS) vulnerability exists in the file upload feature of lm-sys/fastchat version 0.2.36
- CVE-2024-10908 MEDIUM 6.1 DOWNGRADE An open redirect vulnerability in lm-sys/fastchat Release v0.2.36 allows a remote unauthenticated attacker to
- CVE-2024-10907 HIGH 7.5 DOWNGRADE In lm-sys/fastchat Release v0.2.36, the server fails to handle excessive characters appended to the end of mul
- CVE-2024-10044 CRITICAL 9.3 DOWNGRADE A Server-Side Request Forgery (SSRF) vulnerability exists in the POST /worker_generate_stream API endpoint of
FAQ
How do I fix lm-sys vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is lm-sys being exploited right now?
None of the tracked lm-sys CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which lm-sys CVE should I patch first?
CVE-2024-10044 currently ranks highest (54/100): A Server-Side Request Forgery (SSRF) vulnerability exists in the POST /worker_generate_stream API endpoint of .