Executive brief
PaddlePaddle FastDeploy is a toolkit used for deploying machine learning models. A flaw in its caching mechanism allows different data inputs to be treated as identical if they share the same raw byte patterns, even if their structure or data types differ. This could lead to the system returning incorrect cached results, potentially causing the application to behave unpredictably or process data incorrectly.
Technical details
A vulnerability exists in the `hash_features` function within `fastdeploy/multimodal/hasher.py` of PaddlePaddle FastDeploy up to version 2.4.1. The component uses `numpy.ndarray.tobytes()` to generate SHA-256 digests for cache keys in the Processor, Encoder, and Prefix cache managers. Because `tobytes()` only serializes raw element bytes and excludes metadata like 'shape' or 'dtype', different arrays (e.g., different dimensions or data types) that share the same underlying byte sequence result in identical hashes. An attacker with local access could potentially manipulate input data to trigger these collisions, leading to silent cache corruption and the retrieval of incorrect multimodal features. This has been addressed in commit 3749457 by prepending shape and dtype metadata to the hash payload.
Affected products
- PaddlePaddle FastDeploy up to 2.4.1
Timeline
- 2026-04-03: disclosed: Issue first reported on GitHub
- 2026-04-08: patched: Fix merged into develop branch
- 2026-06-04: advisory: CVE published
References
- https://github.com/PaddlePaddle/FastDeploy/
- https://github.com/PaddlePaddle/FastDeploy/commit/374945747652a8d32965591c0c01a00c88b7067f
- https://github.com/PaddlePaddle/FastDeploy/issues/7196
- https://github.com/PaddlePaddle/FastDeploy/pull/7185
- https://vuldb.com/cve/CVE-2026-10800
- https://vuldb.com/submit/831452
- https://vuldb.com/vuln/368249