CVE-2026-6607: 
Python vulnerability analysis and mitigation

CVE-2026-6607 is a Denial of Service vulnerability caused by uncontrolled resource consumption (event loop blocking) in lm-sys FastChat versions up to and including 0.2.36. The flaw affects the Worker API Endpoint, specifically the api_generate function in multi_model_worker.py, api_get_embeddings in base_model_worker.py, and api_generate in huggingface_api_worker.py. It was disclosed on April 20, 2026, and stems from an incomplete prior fix (commit ff66426) that addressed only one of four vulnerable call sites. It carries a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 5.5 (Medium) (GitHub Advisory, Feedly).

The root cause is improper handling of synchronous blocking calls within Python async def FastAPI/uvicorn route handlers (CWE-400: Uncontrolled Resource Consumption; CWE-404: Improper Resource Shutdown or Release). Python's asyncio event loop is single-threaded; when a synchronous, long-running function such as worker.generate_gate(params) (GPU inference, 30–120+ seconds) or worker.get_embeddings(params) is called directly inside an async handler without asyncio.to_thread(), the entire event loop freezes for the duration. A prior fix (commit ff66426) correctly wrapped generate_gate in base_model_worker.py:api_generate() with asyncio.to_thread(), but missed three other identical patterns: api_get_embeddings() in base_model_worker.py (line 218), api_generate() in multi_model_worker.py (line 112), and api_generate() in huggingface_api_worker.py (line 236). No authentication is required to reach these endpoints (GitHub Issue #3833, PoC Gist).

A single unauthenticated HTTP POST request to /worker_get_embeddings or /worker_generate on a vulnerable worker can freeze the entire asyncio event loop for the duration of inference, preventing all concurrent requests — including heartbeats and health checks — from being processed. This causes the FastChat controller to deregister the worker after heartbeat timeout, making all models served by that worker unavailable to all users. In multi_model_worker deployments, all models on the affected worker are simultaneously taken offline, and an attacker can sustain the denial of service by chaining sequential blocking requests (GitHub Issue #3833, PoC Gist).

A public proof-of-concept (PoC) was disclosed by researcher YLChen-007 in a GitHub Gist and linked in the FastChat issue tracker, demonstrating an 819x response time amplification (11ms baseline vs. 9,014ms under attack) against the vulnerable /worker_get_embeddings endpoint. The EPSS score is approximately 0.045%, and there is no evidence of active in-the-wild exploitation or CISA KEV catalog listing at this time. No threat actor attribution has been reported. The vulnerability requires no authentication, no user interaction, and low attack complexity, making it trivially exploitable by any network-accessible attacker (GitHub Issue #3833, GitHub Advisory).

1. Reconnaissance: Identify internet-facing or network-accessible FastChat model worker instances (default port 21002) running fschat package version ≤ 0.2.36 using network scanning tools such as Shodan, Censys, or nmap.
2. Identify vulnerable endpoints: Confirm the worker exposes /worker_get_embeddings, /worker_generate (on multi_model_worker or huggingface_api_worker), or /worker_get_status endpoints via HTTP.
3. Send blocking request to vulnerable endpoint: Issue an unauthenticated HTTP POST to the vulnerable endpoint, e.g.:

curl -s -X POST http://<target>:21002/worker_get_embeddings \
  -H "Content-Type: application/json" \
  -d '{"input":["test"]}'

This triggers a synchronous blocking call (worker.get_embeddings(params)) that freezes the asyncio event loop for the entire inference duration (seconds to minutes). 4. Verify DoS effect: While the blocking request is in flight, send a health check to confirm the event loop is frozen:

time curl -s -X POST http://<target>:21002/worker_get_status \
  -H "Content-Type: application/json" -d '{}'

A delayed response (e.g., 9+ seconds vs. ~11ms baseline) confirms successful exploitation. 5. Sustain the DoS: Chain sequential blocking requests to keep the worker perpetually frozen, preventing heartbeat responses and causing the FastChat controller to deregister the worker, taking all served models offline (GitHub Issue #3833, PoC Gist).

• Network: Repeated unauthenticated HTTP POST requests to /worker_get_embeddings, /worker_generate, or /worker_get_status on FastChat worker ports (default 21002) from external or unexpected source IPs; unusually high request volume to worker endpoints.
• Logs: FastChat worker access logs showing requests to /worker_get_embeddings or /worker_generate with abnormally long response times (seconds to minutes); controller logs showing repeated worker deregistration events due to missed heartbeats.
• Process/System: Sustained high CPU or GPU utilization on the worker host with no corresponding legitimate inference workload; asyncio event loop appearing unresponsive (no heartbeat acknowledgments sent to controller).
• Application: FastChat controller logs indicating worker timeout/deregistration (worker heartbeat timeout) shortly after requests to the above endpoints; model availability dropping to zero for all models on the affected worker (GitHub Issue #3833).

Apply the patch in commit c9e84b89c91d45191dc24466888de526fa04cf33, which wraps the three remaining synchronous blocking calls with asyncio.to_thread() across base_model_worker.py (line 218), multi_model_worker.py (line 112), and huggingface_api_worker.py (line 236) (Patch Commit, PR #3835). As a network-level workaround, restrict access to FastChat worker ports (e.g., 21002) to trusted internal hosts only using firewall rules, since worker endpoints are not protected by API keys. Monitor system resources for unusual consumption patterns and review all worker handler code to ensure no additional synchronous blocking calls remain in async route handlers.

The vulnerability was reported by researcher YLChen-007 via a GitHub issue and public Gist, with a detailed technical write-up and PoC demonstrating the event loop blocking behavior. A community contributor (kaiisfree) promptly submitted PR #3835 to address the three missed fix locations. No major vendor statements or broad media coverage have been identified beyond the GitHub issue tracker and advisory databases (GitHub Issue #3833, GitHub Advisory).