Dask
Monthly
Deserialization in Dask's from_npy_stack() array loader (dask/array/core.py) allows an attacker who can supply or influence the npy-stack path/directory being loaded to trigger unsafe object deserialization, potentially yielding code execution in the victim's process with high confidentiality, integrity and availability impact (assessed CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Affected are Dask versions through 2026.8.0; this is not exploitation of a listening network service, since successful abuse requires the victim application to deliberately call from_npy_stack() on the attacker-influenced data source (UI:R). Publicly available exploit code exists and the flaw was disclosed via a public GitHub issue, but there is no indication of confirmed active exploitation (CISA KEV) at time of analysis.
Resource exhaustion in Dask up to version 3.0 allows authenticated remote attackers to trigger excessive resource consumption via the `nunique_approx` function in the HyperLogLog (HLL) handler component. The root cause is a HashDoS vulnerability - adversarially crafted string or object-type input values can be engineered to collide within the 32-bit hash space used for approximate distinct counting and shuffle partitioning, causing partition hotspotting and disproportionate CPU/memory load on worker nodes. No public exploit code exists at time of analysis, and the CVSS score of 3.1 (Low) with AC:H and A:L confirms limited real-world availability impact absent a targeted, high-complexity effort.
Dask distributed is a distributed task scheduler for Dask. [CVSS 6.1 MEDIUM]
An issue was discovered in the Dask distributed package before 2021.10.0 for Python. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Deserialization in Dask's from_npy_stack() array loader (dask/array/core.py) allows an attacker who can supply or influence the npy-stack path/directory being loaded to trigger unsafe object deserialization, potentially yielding code execution in the victim's process with high confidentiality, integrity and availability impact (assessed CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Affected are Dask versions through 2026.8.0; this is not exploitation of a listening network service, since successful abuse requires the victim application to deliberately call from_npy_stack() on the attacker-influenced data source (UI:R). Publicly available exploit code exists and the flaw was disclosed via a public GitHub issue, but there is no indication of confirmed active exploitation (CISA KEV) at time of analysis.
Resource exhaustion in Dask up to version 3.0 allows authenticated remote attackers to trigger excessive resource consumption via the `nunique_approx` function in the HyperLogLog (HLL) handler component. The root cause is a HashDoS vulnerability - adversarially crafted string or object-type input values can be engineered to collide within the 32-bit hash space used for approximate distinct counting and shuffle partitioning, causing partition hotspotting and disproportionate CPU/memory load on worker nodes. No public exploit code exists at time of analysis, and the CVSS score of 3.1 (Low) with AC:H and A:L confirms limited real-world availability impact absent a targeted, high-complexity effort.
Dask distributed is a distributed task scheduler for Dask. [CVSS 6.1 MEDIUM]
An issue was discovered in the Dask distributed package before 2021.10.0 for Python. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.