CVE-2026-10800

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-10800", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-06-04T04:57:09.234Z", "datePublished": "2026-06-04T09:45:12.021Z", "dateUpdated": "2026-06-04T15:07:01.551Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-06-04T09:45:12.021Z"}, "title": "PaddlePaddle FastDeploy MultimodalHasher hasher.py hash_features weak hash", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-328", "lang": "en", "description": "Use of Weak Hash"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-327", "lang": "en", "description": "Risky Cryptographic Algorithm"}]}], "affected": [{"vendor": "PaddlePaddle", "product": "FastDeploy", "versions": [{"version": "2.4.0", "status": "affected"}, {"version": "2.4.1", "status": "affected"}], "cpes": ["cpe:2.3:a:paddlepaddle:fastdeploy:*:*:*:*:*:*:*:*"], "modules": ["MultimodalHasher"]}], "descriptions": [{"lang": "en", "value": "A weakness has been identified in PaddlePaddle FastDeploy up to 2.4.1. Affected by this issue is the function hash_features of the file fastdeploy/multimodal/hasher.py of the component MultimodalHasher. Executing a manipulation can lead to use of weak hash. The attack requires local access. A high complexity level is associated with this attack. The exploitation is known to be difficult. This patch is called 374945747652a8d32965591c0c01a00c88b7067f. Applying a patch is advised to resolve this issue."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2, "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X", "baseSeverity": "LOW"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.6, "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C", "baseSeverity": "LOW"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.6, "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C", "baseSeverity": "LOW"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 2.4, "vectorString": "AV:L/AC:H/Au:S/C:N/I:P/A:P/E:ND/RL:OF/RC:C"}}], "timeline": [{"time": "2026-06-04T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-06-04T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-06-04T07:02:12.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Dem0 (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/vuln/368249", "name": "VDB-368249 | PaddlePaddle FastDeploy MultimodalHasher hasher.py hash_features weak hash", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/368249/cti", "name": "VDB-368249 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-10800", "name": "CVE-2026-10800 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/831452", "name": "Submit #831452 | PaddlePaddle FastDeploy 2.4.1_20260331_0 hash collision", "tags": ["third-party-advisory"]}, {"url": "https://github.com/PaddlePaddle/FastDeploy/issues/7196", "tags": ["issue-tracking"]}, {"url": "https://github.com/PaddlePaddle/FastDeploy/pull/7185", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/PaddlePaddle/FastDeploy/commit/374945747652a8d32965591c0c01a00c88b7067f", "tags": ["patch"]}, {"url": "https://github.com/PaddlePaddle/FastDeploy/", "tags": ["product"]}], "tags": ["x_open-source"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-04T13:16:45.166669Z", "id": "CVE-2026-10800", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-04T15:07:01.551Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-10800", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-04T13:16:45.166669Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-04T13:38:59.139Z"}}], "cna": {"tags": ["x_open-source"], "title": "PaddlePaddle FastDeploy MultimodalHasher hasher.py hash_features weak hash", "credits": [{"lang": "en", "type": "reporter", "value": "Dem0 (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2, "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.6, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.6, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 2.4, "vectorString": "AV:L/AC:H/Au:S/C:N/I:P/A:P/E:ND/RL:OF/RC:C"}}], "affected": [{"cpes": ["cpe:2.3:a:paddlepaddle:fastdeploy:*:*:*:*:*:*:*:*"], "vendor": "PaddlePaddle", "modules": ["MultimodalHasher"], "product": "FastDeploy", "versions": [{"status": "affected", "version": "2.4.0"}, {"status": "affected", "version": "2.4.1"}]}], "timeline": [{"lang": "en", "time": "2026-06-04T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-06-04T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-06-04T07:02:12.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/368249", "name": "VDB-368249 | PaddlePaddle FastDeploy MultimodalHasher hasher.py hash_features weak hash", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/368249/cti", "name": "VDB-368249 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-10800", "name": "CVE-2026-10800 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/831452", "name": "Submit #831452 | PaddlePaddle FastDeploy 2.4.1_20260331_0 hash collision", "tags": ["third-party-advisory"]}, {"url": "https://github.com/PaddlePaddle/FastDeploy/issues/7196", "tags": ["issue-tracking"]}, {"url": "https://github.com/PaddlePaddle/FastDeploy/pull/7185", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/PaddlePaddle/FastDeploy/commit/374945747652a8d32965591c0c01a00c88b7067f", "tags": ["patch"]}, {"url": "https://github.com/PaddlePaddle/FastDeploy/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A weakness has been identified in PaddlePaddle FastDeploy up to 2.4.1. Affected by this issue is the function hash_features of the file fastdeploy/multimodal/hasher.py of the component MultimodalHasher. Executing a manipulation can lead to use of weak hash. The attack requires local access. A high complexity level is associated with this attack. The exploitation is known to be difficult. This patch is called 374945747652a8d32965591c0c01a00c88b7067f. Applying a patch is advised to resolve this issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-328", "description": "Use of Weak Hash"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-327", "description": "Risky Cryptographic Algorithm"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-06-04T09:45:12.021Z"}}}, "cveMetadata": {"cveId": "CVE-2026-10800", "state": "PUBLISHED", "dateUpdated": "2026-06-04T15:07:01.551Z", "dateReserved": "2026-06-04T04:57:09.234Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-06-04T09:45:12.021Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:paddlepaddle:fastdeploy:*:*:*:*:*:*:*:*"], "modules": ["MultimodalHasher"], "product": "FastDeploy", "vendor": "PaddlePaddle", "versions": [{"status": "affected", "version": "2.4.0"}, {"status": "affected", "version": "2.4.1"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A weakness has been identified in PaddlePaddle FastDeploy up to 2.4.1. Affected by this issue is the function hash_features of the file fastdeploy/multimodal/hasher.py of the component MultimodalHasher. Executing a manipulation can lead to use of weak hash. The attack requires local access. A high complexity level is associated with this attack. The exploitation is known to be difficult. This patch is called 374945747652a8d32965591c0c01a00c88b7067f. Applying a patch is advised to resolve this issue."}, {"lang": "es", "value": "Se ha identificado una debilidad en PaddlePaddle FastDeploy hasta la versi\u00f3n 2.4.1. Afectada por este problema es la funci\u00f3n hash_features del archivo fastdeploy/multimodal/hasher.py del componente MultimodalHasher. La ejecuci\u00f3n de una manipulaci\u00f3n puede llevar al uso de un hash d\u00e9bil. El ataque requiere acceso local. Se asocia un alto nivel de complejidad con este ataque. Se sabe que la explotaci\u00f3n es dif\u00edcil. Este parche se llama 374945747652a8d32965591c0c01a00c88b7067f. Se aconseja aplicar un parche para resolver este problema."}], "id": "CVE-2026-10800", "lastModified": "2026-07-22T20:10:00.127", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "HIGH", "accessVector": "LOCAL", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 2.4, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:H/Au:S/C:N/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 1.5, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.6, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 2.5, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.0, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-10800", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-04T13:16:45.166669Z", "version": "2.0.3"}}]}, "published": "2026-06-04T10:16:38.633", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/PaddlePaddle/FastDeploy/"}, {"source": "cna@vuldb.com", "url": "https://github.com/PaddlePaddle/FastDeploy/commit/374945747652a8d32965591c0c01a00c88b7067f"}, {"source": "cna@vuldb.com", "url": "https://github.com/PaddlePaddle/FastDeploy/issues/7196"}, {"source": "cna@vuldb.com", "url": "https://github.com/PaddlePaddle/FastDeploy/pull/7185"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-10800"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/831452"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/368249"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/368249/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-327"}, {"lang": "en", "value": "CWE-328"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.4.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.4.1"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "FastDeploy", "source": "cna", "vendor": "PaddlePaddle"}, "product": "fastdeploy", "vendor": "paddlepaddle"}], "created": "2026-06-04T11:30:12.470440+00:00", "updated": "2026-06-05T10:08:23.065144+00:00", "vendors": ["paddlepaddle", "paddlepaddle$PRODUCT$fastdeploy"]}