Affecting the api_generate function in lm-sys FastChat, the vulnerability allows a remote attacker to cause excessive resource consumption by submitting crafted requests. The flaw arises from insufficient input validation or rate limiting within the Worker API Endpoint, leading to uncontrolled memory or CPU usage, which can degrade service availability for legitimate users.

All installations of lm-sys FastChat up to and including version 0.2.36 are susceptible. The issue resides in the Worker API Endpoint api_generate function, defined in base_model_worker.py. No newer releases publicly identify a fix for this specific path, so any deployment of the affected version must be updated.

The CVSS score of 6.9 places the flaw in the medium severity range. Although its EPSS score is not publicly available, the vulnerability has been demonstrated publicly and can be triggered remotely without local access. It is not listed in CISA’s KEV catalog, but the remote nature and confirmed exploit suggest a realistic attack vector. The commit that patches api_generate in base_model_worker.py (c9e84b89) addresses this path, yet a separate commit (ff66426) noted that other entry points may remain unpatched, potentially extending the risk.