aqueduct-llm (=0.0.1) potentially affected by CVE-2026-6607 via fschat (=0.2.2)

fschat PYPI version =0.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on fschat and may be impacted: - aqueduct-llm =0.0.1 Source cves: CVE-2026-6607 Source advisory: OSV:GHSA-5H65-JX66-J7P5...

CVE-2026-6607

CVE-2026-6607 affects lm-sys FastChat up to version 0.2.36, specifically the Worker API Endpoint function api_generate. The issue allows remote manipulation leading to resource consumption; CVE details indicate a publicly disclosed exploit and a patch is available (patch id c9e84b89c91d45191dc244...