CVE-2026-10705

A flaw has been found in dask up to 3.0. Affected by this issue is the function nunique_approx of the file dask/dataframe/hyperloglog.py of the component HLL Handler. This manipulation causes resource consumption. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. The exploitation is known to be difficult. The pull request to fix this issue awaits acceptance.

CVSS v3 3.1 LOW
CVSS v2.0 2.1 LOW

3.1^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.6 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

2.1^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:H/Au:S/C:N/I:N/A:P

Exploitability : 3.9 / Impact : 2.9

Access Vector NETWORK

Access Complexity HIGH

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
https://github.com/dask/dask/
https://github.com/dask/dask/issues/12403
https://github.com/dask/dask/pull/12401
https://vuldb.com/cve/CVE-2026-10705
https://vuldb.com/submit/831411
https://vuldb.com/vuln/368018
https://vuldb.com/vuln/368018/cti

Configurations

No configuration.

History

22 Jul 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Se ha encontrado una vulnerabilidad en dask hasta la versión 3.0. Se ve afectada por este problema la función nunique_approx del archivo dask/dataframe/hyperloglog.py del componente HLL Gestor. Esta manipulación provoca consumo de recursos. El ataque puede llevarse a cabo de forma remota. Se requiere un alto grado de complejidad para el ataque. Se sabe que la explotación es difícil. La solicitud de extracción para corregir este problema espera aceptación.

03 Jun 2026, 02:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-03 02:16

Updated : 2026-07-22 19:10

NVD link : CVE-2026-10705

Mitre link : CVE-2026-10705

CVE.ORG link : CVE-2026-10705

JSON object : View

Products Affected

No product.

CWE

CWE-400

Uncontrolled Resource Consumption

CWE-404

Improper Resource Shutdown or Release

{"id": "CVE-2026-10705", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-10705", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-03T14:11:33.203540Z"}}], "cvssMetricV2": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"version": "2.0", "baseScore": 2.1, "accessVector": "NETWORK", "vectorString": "AV:N/AC:H/Au:S/C:N/I:N/A:P", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "HIGH", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.1, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.6}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cna@vuldb.com", "affectedData": [{"cpes": ["cpe:2.3:a:dask:dask:*:*:*:*:*:*:*:*"], "vendor": "n/a", "modules": ["HLL Handler"], "product": "dask", "versions": [{"status": "affected", "version": "3.0"}]}]}], "published": "2026-06-03T02:16:17.397", "references": [{"url": "https://github.com/dask/dask/", "source": "cna@vuldb.com"}, {"url": "https://github.com/dask/dask/issues/12403", "source": "cna@vuldb.com"}, {"url": "https://github.com/dask/dask/pull/12401", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/cve/CVE-2026-10705", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/submit/831411", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/368018", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/368018/cti", "source": "cna@vuldb.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cna@vuldb.com", "description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-404"}]}], "descriptions": [{"lang": "en", "value": "A flaw has been found in dask up to 3.0. Affected by this issue is the function nunique_approx of the file dask/dataframe/hyperloglog.py of the component HLL Handler. This manipulation causes resource consumption. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. The exploitation is known to be difficult. The pull request to fix this issue awaits acceptance."}, {"lang": "es", "value": "Se ha encontrado una vulnerabilidad en dask hasta la versi\u00f3n 3.0. Se ve afectada por este problema la funci\u00f3n nunique_approx del archivo dask/dataframe/hyperloglog.py del componente HLL Gestor. Esta manipulaci\u00f3n provoca consumo de recursos. El ataque puede llevarse a cabo de forma remota. Se requiere un alto grado de complejidad para el ataque. Se sabe que la explotaci\u00f3n es dif\u00edcil. La solicitud de extracci\u00f3n para corregir este problema espera aceptaci\u00f3n."}], "lastModified": "2026-07-22T19:10:00.120", "sourceIdentifier": "cna@vuldb.com"}