Is there a patch available for EUVD-2026-34246?

Yes, a patch is available for EUVD-2026-34246. Update the affected software to the latest version immediately.

Streamlit EUVD-2026-34246

Q: What is the CVSS score of EUVD-2026-34246?

EUVD-2026-34246 has a CVSS 4.0 base score of 1.1 (Low). CVSS vector: CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-10804 LOW

Use of a Broken or Risky Cryptographic Algorithm (CWE-327)

2026-06-04 cna@vuldb.com

GHSA-vqwp-45wm-r9r5

Information Disclosure Streamlit

1.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

1.1 LOW

CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 04, 2026 - 12:37 vuln.today

Analysis Generated

Jun 04, 2026 - 12:37 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

4 pypi packages depend on streamlit (4 direct, 0 indirect)

Ecosystem-wide dependent count for version 1.53.1.

DescriptionCVE.org

A vulnerability has been found in Streamlit up to 1.53.0. Impacted is an unknown function in the library lib/streamlit/runtime/caching/hashing.py of the component Palette Handler. Such manipulation leads to use of weak hash. Local access is required to approach this attack. The attack requires a high level of complexity. The exploitability is considered difficult. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance.

AnalysisAI

Hash collision vulnerability in Streamlit's caching layer (versions up to 1.53.0) allows a local low-privileged attacker to poison the application cache by supplying crafted PIL palette-mode images or large dataframes that produce identical hash digests for distinct objects. The root cause is twofold: PIL 'P'-mode (palette-indexed) images excluded palette data from the hash computation entirely, and fixed seed values (random_state=0) were used when sampling large pandas, numpy, and polars objects - both enabling deterministic hash collisions. No public exploit identified at time of analysis beyond the public disclosure of the issue. EPSS data is not available, but the CVSS 1.1 score (AV:L/AC:H/PR:L) places real-world risk as very low.

Technical ContextAI

The vulnerable component is lib/streamlit/runtime/caching/hashing.py, specifically the _HashStack._to_bytes method used by Streamlit's @st.cache_data and @st.cache_resource decorators to produce cache keys for function arguments. CWE-327 (Use of a Broken or Risky Cryptographic Algorithm) applies because the hash function produced non-unique digests: PIL images in 'P' (palette) mode were hashed using only their raw pixel index buffer via np.frombuffer(pil_obj.tobytes()), completely ignoring the palette color table, so two images sharing identical index buffers but entirely different color palettes were treated as equivalent. Separately, large pandas Series, DataFrames, numpy arrays, and polars objects were sampled before hashing using a globally fixed seed (random_state=0 / seed=0), meaning the same subset of rows/elements was always chosen regardless of the object's content - allowing a crafted object to match the hash of a different object if their sampled subsets collide. The fix (PR #14635, awaiting merge) introduces data-dependent seeds (_pandas_sample_seed, _numpy_sample_seed, _polars_sample_seed) derived from an MD5 digest of a content prefix, and prepends palette bytes to the pixel buffer for P-mode images prior to hashing. MD5 is used with usedforsecurity=False, which is appropriate here since the goal is cache disambiguation, not cryptographic integrity.

RemediationAI

No vendor-released patched version has been confirmed at time of analysis - the fix is contained in GitHub pull request #14635 (https://github.com/streamlit/streamlit/pull/14635), which awaits acceptance and has not been merged into a tagged release. Once merged and released, upgrading to the first version that includes PR #14635 is the primary remediation. As a compensating control, developers using Streamlit's caching decorators (@st.cache_data, @st.cache_resource) with functions that accept PIL P-mode (palette-indexed) images should convert images to RGB or RGBA mode before passing them to cached functions (e.g., img = img.convert('RGB')), which avoids the palette exclusion defect entirely; this has no functional side effect for most image-processing workflows. For large pandas/numpy/polars inputs, consider adding an explicit hash_funcs argument to the cache decorator to supply a deterministic, content-aware hash function, bypassing the vulnerable sampling path. These workarounds are low-risk but require application-level code changes.