Is there a patch available for CVE-2026-10800?

Yes, a patch is available for CVE-2026-10800. Update the affected software to the latest version immediately.

FastDeploy CVE-2026-10800

Q: What is the CVSS score of CVE-2026-10800?

CVE-2026-10800 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-34239 LOW

Use of Weak Hash (CWE-328)

2026-06-04 VulDB

GHSA-jrwr-h52h-9hh6

Information Disclosure Fastdeploy

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 04, 2026 - 10:24 vuln.today

Analysis Generated

Jun 04, 2026 - 10:24 vuln.today

CVSS changed

Jun 04, 2026 - 10:22 NVD

3.6 (LOW) 2.0 (LOW)

DescriptionCVE.org

A weakness has been identified in PaddlePaddle FastDeploy up to 2.4.1. Affected by this issue is the function hash_features of the file fastdeploy/multimodal/hasher.py of the component MultimodalHasher. Executing a manipulation can lead to use of weak hash. The attack requires local access. A high complexity level is associated with this attack. The exploitation is known to be difficult. This patch is called 374945747652a8d32965591c0c01a00c88b7067f. Applying a patch is advised to resolve this issue.

AnalysisAI

Hash collision weakness in PaddlePaddle FastDeploy up to version 2.4.1 allows a local attacker with low privileges to cause the MultimodalHasher component to produce identical SHA-256 digests for semantically distinct numpy arrays that share raw byte content but differ in shape or dtype. This breaks the uniqueness guarantee of the hash_features function in fastdeploy/multimodal/hasher.py, enabling integrity violations in multimodal data pipelines relying on this component for deduplication or identity checks. No public exploit exists and no active exploitation is confirmed; the CVSS 4.0 score of 2.0 accurately reflects constrained real-world risk given local-only access and high attack complexity.

Technical ContextAI

The vulnerability resides in the MultimodalHasher.hash_features method within fastdeploy/multimodal/hasher.py. The original implementation computed hashlib.sha256(obj.tobytes()).hexdigest() - serializing only the raw byte content of a numpy array - without incorporating the array's shape or dtype metadata into the hash input. Because numpy arrays with different shapes (e.g., a 6×4 versus a 4×6 array) or different dtypes (e.g., float32 versus uint8) can produce identical raw byte representations when derived from the same underlying data buffer, the function would return the same SHA-256 digest for semantically distinct inputs. CWE-328 (Use of Weak Hash) applies here not because SHA-256 is cryptographically weak, but because the hash input is semantically incomplete - omitting discriminating array attributes (shape and dtype) violates the effective uniqueness property required for correct operation. The affected CPE is cpe:2.3:a:paddlepaddle:fastdeploy:*:*:*:*:*:*:*:*, covering all versions up to and including 2.4.1. The patch (commit 374945747652a8d32965591c0c01a00c88b7067f) resolves this by prepending a header string encoding shape and dtype before hashing the raw bytes.

RemediationAI

Apply the upstream fix available via GitHub commit 374945747652a8d32965591c0c01a00c88b7067f (https://github.com/PaddlePaddle/FastDeploy/commit/374945747652a8d32965591c0c01a00c88b7067f) or pull request https://github.com/PaddlePaddle/FastDeploy/pull/7185. The patch encodes array shape and dtype into a header prefix before hashing raw bytes, ensuring that arrays differing in layout or type produce distinct digests. Note that a formally tagged patched release version has not been independently confirmed from the available data - the fix exists as a merged commit and PR, so users should build from the patched HEAD or verify their installed version includes this specific commit. As a compensating control where immediate patching is not feasible, applications relying on hash_features for deduplication or caching should independently validate array shape and dtype equality before treating hash matches as conclusive; this adds application-layer overhead but eliminates the collision risk without requiring a FastDeploy upgrade.