CVE-2026-6607

OVERVIEW CVE-2026-6607 is a resource consumption vulnerability in lm-sys FastChat versions up to 0.2.36, specifically affecting the api_generate function in the Worker API Endpoint. This flaw enables remote attackers to exhaust system resources without requiring authentication or user interaction, potentially leading to denial of service conditions. SEVERITY The vulnerability carries a CVSS score of 5.3 (Medium severity) with a network-based attack vector that requires no special privileges or user interaction. While the attack complexity is low and accessibility is straightforward for remote actors, the impact is limited to availability; no confidentiality or integrity compromise is possible. The EPSS score of 0.00017 indicates this vulnerability ranks lower than 99.95 percent of all CVEs in terms of real-world exploitation likelihood. EXPLOITATION STATUS The vulnerability has been publicly disclosed and patches are available, including commit c9e84b89c91d45191dc24466888de526fa04cf33. However, the initial patch in commit ff66426 was incomplete, as it addressed only the primary entry point while missing other vulnerable code paths. The vulnerability is listed on the Active Hot List and requires immediate patching to prevent potential resource exhaustion attacks, despite the currently low empirical exploitation rate.