CVE-2026-10705

NameCVE-2026-10705
DescriptionA flaw has been found in dask up to 3.0. Affected by this issue is the function nunique_approx of the file dask/dataframe/hyperloglog.py of the component HLL Handler. This manipulation causes resource consumption. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. The exploitation is known to be difficult. The pull request to fix this issue awaits acceptance.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
dask (PTS)bullseye2021.01.0+dfsg-1vulnerable
bookworm2022.12.1+dfsg-2vulnerable
trixie2024.12.1+dfsg-2vulnerable
forky, sid2024.12.1+dfsg-3vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
dasksource(unstable)(unfixed)

Notes

https://github.com/dask/dask/issues/12403
https://github.com/dask/dask/pull/12401

Search for package or bug name: Reporting problems