CVE-2026-6607 Details

A denial-of-service vulnerability has been identified in lm-sys FastChat versions through 0.2.36. The issue arises in the Worker API Endpoint, specifically within the 'api_generate' and 'api_get_embeddings' functions. These endpoints are part of the FastAPI application and are intended to be non-blocking. However, they directly execute synchronous, resource-intensive tasks, such as GPU inference and network requests to the Hugging Face Inference API, on the main event loop thread. This oversight completely freezes the asyncio event loop, preventing the server from processing concurrent requests or responding to vital health check signals. As a result, the affected model worker becomes unresponsive for the duration of the blocked operation, which can range from several seconds to minutes, depending on the task.

Users are advised to update to the patched version of FastChat, where this vulnerability has been addressed by wrapping the blocking calls in 'asyncio.to_thread()', allowing them to be processed without freezing the event loop.