CVE-2026-10812 json
zilliztech GPTCache Cache Key pre.py BufferedReader.peek weak hash
published 2026-06-04 5 mo ago modified 2026-07-23 3 mo ago also GHSA-xfqj-4cr9-9gr5 , PYSEC-2026-3468 , EUVD-2026-34272
- cvss
- 3.6
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.1%
- EPSS 0.1% chance of exploitation in 30 days, percentile 0%
- public exploits
- 0
- none known
Summary
A vulnerability was detected in zilliztech GPTCache up to 0.1.44. Affected by this issue is the function BufferedReader.peek of the file gptcache/processor/pre.py of the component Cache Key Handler. Performing a manipulation of the argument input_data["image"] results in use of weak hash. The attack must be initiated from a local position. The attack is considered to have high complexity. The exploitation is known to be difficult. The exploit is now public and may be used. The pull request to fix this issue awaits acceptance.
Patch / fix
- github.com/zilliztech/GPTCache#678 pull request
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 5 mo ago
Exploit prediction
0.07% chance of exploitation in the next 30 days, higher than 0% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/zilliztech/GPTCache/issues/684 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 2.0 | CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P |
| CNA | 3.1 | 3.6 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R |
| CNA | 3.0 | 3.6 | CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R |
| CNA | 2.0 | 2.4 | AV:L/AC:H/Au:S/C:N/I:P/A:P/E:POC/RL:ND/RC:UR |
| CNA | 4.0 | 1.1 | CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| CNA | 3.1 | 3.6 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L |
| CNA | 2.0 | 2.4 | AV:L/AC:H/Au:S/C:N/I:P/A:P |
| GitHub | 3.1 | 3.6 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L |
| OSV | 3.1 | 3.6 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | gptcache | <=0.1.44 |
no fix listed |
Affected products
- zilliztech GPTCache
Classification
References
-
github.com
/zilliztech/GPTCache/pull/678
issue-tracking, patch, web
-
github.com
/zilliztech/GPTCache/issues/684
exploit, issue-tracking, web
-
vuldb.com
/vuln/368260
vdb-entry, technical-description, web
-
vuldb.com
/vuln/368260/cti
signature, permissions-required, web
-
vuldb.com
/cve/CVE-2026-10812
third-party-advisory, web
-
vuldb.com
/submit/831636
third-party-advisory, web
-
github.com
/zilliztech/GPTCache/
product
-
nvd.nist.gov
/vuln/detail/CVE-2026-10812
advisory
-
github.com
/zilliztech/GPTCache
package
-
pypi.org
/project/gptcache
package
-
github.com
/advisories/GHSA-xfqj-4cr9-9gr5
advisory
Sources
- CVE List CVE-2026-10812
- GitHub Advisory GHSA-xfqj-4cr9-9gr5
- NVD CVE-2026-10812
- OSV PYSEC-2026-3468
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.