CVE-2026-10705

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-10705", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-06-02T17:46:25.630Z", "datePublished": "2026-06-03T01:15:10.343Z", "dateUpdated": "2026-06-03T14:11:44.133Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-06-03T01:15:10.343Z"}, "title": "dask HLL hyperloglog.py nunique_approx resource consumption", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-400", "lang": "en", "description": "Resource Consumption"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-404", "lang": "en", "description": "Denial of Service"}]}], "affected": [{"vendor": "n/a", "product": "dask", "versions": [{"version": "3.0", "status": "affected"}], "cpes": ["cpe:2.3:a:dask:dask:*:*:*:*:*:*:*:*"], "modules": ["HLL Handler"]}], "descriptions": [{"lang": "en", "value": "A flaw has been found in dask up to 3.0. Affected by this issue is the function nunique_approx of the file dask/dataframe/hyperloglog.py of the component HLL Handler. This manipulation causes resource consumption. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. The exploitation is known to be difficult. The pull request to fix this issue awaits acceptance."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2.3, "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X", "baseSeverity": "LOW"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.1, "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 2.1, "vectorString": "AV:N/AC:H/Au:S/C:N/I:N/A:P/E:ND/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-06-02T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-06-02T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-06-02T19:51:54.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Dem0 (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/368018", "name": "VDB-368018 | dask HLL hyperloglog.py nunique_approx resource consumption", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/368018/cti", "name": "VDB-368018 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-10705", "name": "CVE-2026-10705 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/831411", "name": "Submit #831411 | dask 2026.3.0 Algorithmic Complexity / Hash Collision / Denial of Service", "tags": ["third-party-advisory"]}, {"url": "https://github.com/dask/dask/issues/12403", "tags": ["issue-tracking"]}, {"url": "https://github.com/dask/dask/pull/12401", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/dask/dask/", "tags": ["product"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-03T14:11:33.203540Z", "id": "CVE-2026-10705", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-03T14:11:44.133Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-10705", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-03T14:11:33.203540Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-03T14:11:39.991Z"}}], "cna": {"title": "dask HLL hyperloglog.py nunique_approx resource consumption", "credits": [{"lang": "en", "type": "reporter", "value": "Dem0 (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2.3, "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.1, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.1, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 2.1, "vectorString": "AV:N/AC:H/Au:S/C:N/I:N/A:P/E:ND/RL:ND/RC:UR"}}], "affected": [{"cpes": ["cpe:2.3:a:dask:dask:*:*:*:*:*:*:*:*"], "vendor": "n/a", "modules": ["HLL Handler"], "product": "dask", "versions": [{"status": "affected", "version": "3.0"}]}], "timeline": [{"lang": "en", "time": "2026-06-02T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-06-02T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-06-02T19:51:54.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/368018", "name": "VDB-368018 | dask HLL hyperloglog.py nunique_approx resource consumption", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/368018/cti", "name": "VDB-368018 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-10705", "name": "CVE-2026-10705 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/831411", "name": "Submit #831411 | dask 2026.3.0 Algorithmic Complexity / Hash Collision / Denial of Service", "tags": ["third-party-advisory"]}, {"url": "https://github.com/dask/dask/issues/12403", "tags": ["issue-tracking"]}, {"url": "https://github.com/dask/dask/pull/12401", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/dask/dask/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A flaw has been found in dask up to 3.0. Affected by this issue is the function nunique_approx of the file dask/dataframe/hyperloglog.py of the component HLL Handler. This manipulation causes resource consumption. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. The exploitation is known to be difficult. The pull request to fix this issue awaits acceptance."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "Resource Consumption"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-404", "description": "Denial of Service"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-06-03T01:15:10.343Z"}}}, "cveMetadata": {"cveId": "CVE-2026-10705", "state": "PUBLISHED", "dateUpdated": "2026-06-03T14:11:44.133Z", "dateReserved": "2026-06-02T17:46:25.630Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-06-03T01:15:10.343Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:dask:dask:*:*:*:*:*:*:*:*"], "modules": ["HLL Handler"], "product": "dask", "vendor": "n/a", "versions": [{"status": "affected", "version": "3.0"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw has been found in dask up to 3.0. Affected by this issue is the function nunique_approx of the file dask/dataframe/hyperloglog.py of the component HLL Handler. This manipulation causes resource consumption. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. The exploitation is known to be difficult. The pull request to fix this issue awaits acceptance."}, {"lang": "es", "value": "Se ha encontrado una vulnerabilidad en dask hasta la versi\u00f3n 3.0. Se ve afectada por este problema la funci\u00f3n nunique_approx del archivo dask/dataframe/hyperloglog.py del componente HLL Gestor. Esta manipulaci\u00f3n provoca consumo de recursos. El ataque puede llevarse a cabo de forma remota. Se requiere un alto grado de complejidad para el ataque. Se sabe que la explotaci\u00f3n es dif\u00edcil. La solicitud de extracci\u00f3n para corregir este problema espera aceptaci\u00f3n."}], "id": "CVE-2026-10705", "lastModified": "2026-07-22T19:10:00.120", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "HIGH", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 2.1, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:H/Au:S/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.3, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-10705", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-03T14:11:33.203540Z", "version": "2.0.3"}}]}, "published": "2026-06-03T02:16:17.397", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/dask/dask/"}, {"source": "cna@vuldb.com", "url": "https://github.com/dask/dask/issues/12403"}, {"source": "cna@vuldb.com", "url": "https://github.com/dask/dask/pull/12401"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-10705"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/831411"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/368018"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/368018/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-404"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.0"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}]}, "original": {"product": "dask", "source": "cna", "vendor": "n/a"}, "product": "dask", "vendor": "dask"}], "created": "2026-06-03T03:45:23.911265+00:00", "updated": "2026-06-03T10:54:13.501175+00:00", "vendors": ["dask", "dask$PRODUCT$dask"]}