| शीर्षक | sigoden AIChat 0.30.0 Denial of Service |
|---|
| विवरण | AIChat 0.30.0 has a denial of service vulnerability in its OpenAI-compatible HTTP serve mode.
The /v1/chat/completions, /v1/embeddings, /v1/rerank, and /v1/rags/search endpoints collect the entire HTTP request body into memory before JSON parsing or validation. These routes do not enforce a pre-read body size limit, JSON depth limit, array item limit, string length limit, authentication, rate limit, or concurrency budget.
An unauthenticated client can send an oversized request body and force the AIChat serve process to allocate excessive memory before the request is rejected. In shared gateway, containerized, internal API, or reverse-proxied deployments, this can terminate the service process and make normal chat, model, embedding, rerank, RAG, playground, and arena requests unavailable. |
|---|
| स्रोत | ⚠️ https://github.com/outlookgp/CVE/tree/main/AIChat_Serve_Request_Body_DoS_Report |
|---|
| उपयोगकर्ता | outlookgp (UID 99658) |
|---|
| सबमिशन | 11/07/2026 10:10 AM (2 महीनों पहले) |
|---|
| संयम | 02/09/2026 03:25 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 398132 [sigoden aichat तक 0.30.4 API Endpoint src/serve.rs सेवा अस्वीकार] |
|---|
| अंक | 20 |
|---|