CVE-2023-38676: Medium Null Pointer Crash in PaddlePaddle dot

CVE-2023-38676 is a Medium severity flaw (CVSS 4.7) in PaddlePaddle before 2.6.0. The paddle.dot function can crash the process with a segmentation fault from a null pointer, causing denial of service. The advisory says the fix ships in PaddlePaddle 2.6.0, so upgrade to that release or later.

What's affected

The record lists PaddlePaddle versions before 2.6.0. The project's own advisory, PDSA-2023-008, says the fix is in commit 19da5c0 and will be included in PaddlePaddle 2.6.0. That makes 2.6.0 the first fixed release according to the advisory.

The affected code is the paddle.dot function. Applications that never call it are not exposed through this CVE, though they may still carry the library.

The advisory and the NVD record word the crash slightly differently. When both input tensors have zero-sized shapes, the function ends up dereferencing a null pointer. The NVD record calls it a null pointer issue, and the advisory title calls it a segmentation fault; they describe the same crash.

The same advisory series covers sibling issues. Related: CVE-2023-38677 and CVE-2023-38678, which share the same fix commit.

How to check if you're exposed

Find the installed version in each Python environment, virtual environment and container image that uses Paddle:

pip show paddlepaddle
python -c "import paddle; print(paddle.__version__)"

GPU builds are published under a different package name, so check that too:

pip show paddlepaddle-gpu

Then search your repositories for pinned versions in requirements files, lock files and Dockerfiles:

grep -rIn "paddlepaddle" --include=requirements*.txt --include=pyproject.toml --include=Dockerfile .

Any version below 2.6.0 is in the affected range. Next, ask whether your code calls paddle.dot and whether the shape of the input can be influenced by a user or an upstream data source. That second question decides how urgent this is.

What to do now

1. Inventory every service, notebook and image that imports Paddle, and record the installed version.
2. Upgrade PaddlePaddle to 2.6.0 or later, then re-run your model tests, since a jump across minor versions can change behavior.
3. If you cannot upgrade yet, validate tensor shapes before they reach paddle.dot and reject zero-sized or out-of-range inputs.
4. Run inference services under a supervisor that restarts a crashed worker, and rate limit callers so one request cannot take down a whole pool.
5. Re-scan after the upgrade to confirm no image still carries an older wheel.

Why it matters

The weakness class is CWE-476 (NULL pointer dereference). The function trusts the shape of its input and does not handle the degenerate case, so a malformed or empty tensor turns into a native crash. In a Python process that is not a catchable exception. The whole interpreter dies, along with any other work in it.

The impact is limited to availability. The record scores it 4.7 (Medium) with network access, low complexity, user interaction and a changed scope, and no confidentiality or integrity impact. It is not listed in the CISA Known Exploited Vulnerabilities catalog and no advisory reports exploitation. The practical risk is a model-serving endpoint that accepts shapes from callers you do not control. Reachability analysis helps here, because it tells you whether a vulnerable function is ever called from your code, which separates a real exposure from a library that is merely installed.

Quick check

Sources

• PaddlePaddle advisory PDSA-2023-008
• Record data for CVE-2023-38676: NVD description, CVSS vector and CWE

Last reviewed: 19 October 2026.