CVE-2021-34141
Incorrect Comparison in NumPy
An incomplete string comparison in the numpy.core component in NumPy before 1.22.0 allows attackers to trigger slightly incorrect copying by constructing specific string objects. NOTE: the vendor states that this reported code behavior is "completely harmless."
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
NVD Score used
An incomplete string comparison in the numpy.core component in NumPy before 1.22.0 allows attackers to trigger slightly incorrect copying by constructing specific string objects. NOTE: the vendor states that this reported code behavior is "completely harmless."
- Record
CVE-2021-34141- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-697
- Updated
- 2026-11-02
CVE List No score
An incomplete string comparison in the numpy.core component in NumPy before 1.22.0 allows attackers to trigger slightly incorrect copying by constructing specific string objects. NOTE: the vendor states that this reported code behavior is "completely harmless."
- Record
CVE-2021-34141- Updated
- 2026-11-02
EUVDEUVD-2021-0151 No score
An incomplete string comparison in the numpy.core component in NumPy before 1.22.0 allows attackers to trigger slightly incorrect copying by constructing specific string objects. NOTE: the vendor states that this reported code behavior is "completely harmless."
- Record
EUVD-2021-0151- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-fpfv-jqm9-f5jm
Incorrect Comparison in NumPy
Incomplete string comparison in the numpy.core component in NumPy1.9.x, which allows attackers to fail the APIs via constructing specific string objects.
- Record
GHSA-fpfv-jqm9-f5jm- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-697
- Updated
- 2026-11-02
OSV
An incomplete string comparison in the numpy.core component in NumPy before 1.22.0 allows attackers to trigger slightly incorrect copying by constructing specific string objects. NOTE: the vendor states that this reported code behavior is "completely harmless."
- Record
CVE-2021-34141- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-34141
An incomplete string comparison in the numpy.core component in NumPy before 1.22.0 allows attackers to trigger slightly incorrect copying by constructing specific string objects. NOTE: the vendor states that this reported code behavior is "completely harmless."
- Record
DEBIAN-CVE-2021-34141- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
Show 13 moreShow less
OSVGHSA-fpfv-jqm9-f5jm
Incorrect Comparison in NumPy
Incomplete string comparison in the numpy.core component in NumPy1.9.x, which allows attackers to fail the APIs via constructing specific string objects.
- Record
GHSA-fpfv-jqm9-f5jm- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-697
- Updated
- 2026-11-02
OSVOESA-2022-1522
numpy security update
A fast multidimensional array facility for Python.
Security Fix(es):
Null Pointer Dereference vulnerability exists in numpy.sort in NumPy < and 1.19 in the PyArray_DescrNew function due to missing return-value validation, which allows attackers to conduct DoS attacks by repetitively creating sort arrays.(CVE-2021-41495)
An incomplete string comparison in the numpy.core component in NumPy before 1.22.0 allows attackers to trigger slightly incorrect copying by constructing specific string objects. NOTE: the vendor states that this reported code behavior is "completely harmless."(CVE-2021-34141)
- Record
OESA-2022-1522- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-34141
An incomplete string comparison in the numpy.core component in NumPy before 1.22.0 allows attackers to trigger slightly incorrect copying by constructing specific string objects. NOTE: the vendor states that this reported code behavior is "completely harmless."
- Record
UBUNTU-CVE-2021-34141- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVCLSA-2025-1760400833 No score
TuxCare security update for numpy (1 CVE)
TuxCare rebuilt numpy to address 1 CVE. Fixed in 1.15.4.post2+tuxcare.
- Record
CLSA-2025-1760400833- Updated
- 2026-11-02
OSVCLSA-2026-1781139192 No score
TuxCare security update for numpy (1 CVE)
TuxCare rebuilt numpy to address 1 CVE. Fixed in 1.21.0.post1+tuxcare.
- Record
CLSA-2026-1781139192- Updated
- 2026-11-02
OSVCLSA-2026-1789381947 No score
TuxCare security update for numpy (2 CVEs)
TuxCare rebuilt numpy to address 2 CVEs. Fixed in 1.16.0.post3+tuxcare.
- Record
CLSA-2026-1789381947- Updated
- 2026-11-02
OSVCLSA-2026-1793175147 No score
TuxCare security update for numpy (8 CVEs)
TuxCare rebuilt numpy to address 8 CVEs. Fixed in 2.1.3.post1+tuxcare.
- Record
CLSA-2026-1793175147- Updated
- 2026-11-02
OSVCLSA-2026-1793175390 No score
TuxCare security update for numpy (8 CVEs)
TuxCare rebuilt numpy to address 8 CVEs. Fixed in 2.0.2.post1+tuxcare.
- Record
CLSA-2026-1793175390- Updated
- 2026-11-02
OSVCLSA-2026-1793694087 No score
TuxCare security update for numpy (7 CVEs)
TuxCare rebuilt numpy to address 7 CVEs. Fixed in 2.2.6.post1+tuxcare.
- Record
CLSA-2026-1793694087- Updated
- 2026-11-03
OSVCLSA-2026-1793694742 No score
TuxCare security update for numpy (5 CVEs)
TuxCare rebuilt numpy to address 5 CVEs. Fixed in 1.26.4.post1+tuxcare.
- Record
CLSA-2026-1793694742- Updated
- 2026-11-03
OSVCLSA-2026-1793700288 No score
TuxCare security update for numpy (7 CVEs)
TuxCare rebuilt numpy to address 7 CVEs. Fixed in 1.21.6.post1+tuxcare.
- Record
CLSA-2026-1793700288- Updated
- 2026-11-03
OSVPYSEC-2021-855 No score
Incomplete string comparison in the numpy.core component in NumPy1.9.x, which allows attackers to fail the APIs via constructing specific string objects.
- Record
PYSEC-2021-855- Updated
- 2026-11-02
OSVUSN-5763-1 No score
numpy vulnerabilities
It was discovered that NumPy did not properly manage memory when specifying arrays of large dimensions. If a user were tricked into running malicious Python file, an attacker could cause a denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-33430)
It was discovered that NumPy did not properly perform string comparison operations under certain circumstances. An attacker could possibly use this issue to cause NumPy to crash, resulting in a denial of service. (CVE-2021-34141)
It was discovered that NumPy did not properly manage memory under certain circumstances. An attacker could possibly use this issue to cause NumPy to crash, resulting in a denial of service. (CVE-2021-41495, CVE-2021-41496)
- Record
USN-5763-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
numpyPyPI |
before 1.22 | 1.22 |
numpyTuxCare:PyPI |
1.15.4 up to 1.15.4.post2+tuxcare, plus listed versions 1.15.4.post1+tuxcare |
1.15.4.post2+tuxcare |
numpyTuxCare:PyPI |
1.21.0 up to 1.21.0.post1+tuxcare | 1.21.0.post1+tuxcare |
numpyTuxCare:PyPI From an advisory covering 2 CVEs |
1.16.0 up to 1.16.0.post3+tuxcare, plus listed versions 1.16.0.post1+tuxcare1.16.0.post2+tuxcare |
1.16.0.post3+tuxcare |
numpyTuxCare:PyPI |
2.1.3 up to 2.1.3.post1+tuxcare | 2.1.3.post1+tuxcare |
numpyTuxCare:PyPI |
2.0.2 up to 2.0.2.post1+tuxcare | 2.0.2.post1+tuxcare |
numpyTuxCare:PyPI |
2.2.6 up to 2.2.6.post1+tuxcare | 2.2.6.post1+tuxcare |
numpyTuxCare:PyPI |
1.26.4 up to 1.26.4.post1+tuxcare | 1.26.4.post1+tuxcare |
numpyTuxCare:PyPI From an advisory covering 3 CVEs |
1.21.6 up to 1.21.6.post1+tuxcare | 1.21.6.post1+tuxcare |
numpyDebian:12 |
All versions, plus listed versions 1:1.24.2-11:1.24.2-1+deb12u11:1.24.2-21:1.24.2-2+hurd.11:1.24.2-3 Show 45 moreShow less1:1.26.3-11:1.26.3-21:1.26.4+ds-11:1.26.4+ds-101:1.26.4+ds-111:1.26.4+ds-121:1.26.4+ds-131:1.26.4+ds-21:1.26.4+ds-31:1.26.4+ds-41:1.26.4+ds-51:1.26.4+ds-61:1.26.4+ds-71:1.26.4+ds-81:1.26.4+ds-91:1.26.4+ds-9~exp11:2.1.0+ds-11:2.1.0+ds-21:2.1.1+ds-11:2.1.1+ds-21:2.1.1+ds-31:2.1.2+ds-11:2.1.3+ds-11:2.1.3+ds-21:2.2.0+ds-11:2.2.1+ds-11:2.2.1+ds-21:2.2.2+ds-11:2.2.2+ds-21:2.2.3+ds-11:2.2.3+ds-21:2.2.3+ds-31:2.2.3+ds-41:2.2.3+ds-51:2.2.4+ds-11:2.2.4+ds-1.11:2.2.4+ds-1.21:2.3.2+ds-11:2.3.3+ds-11:2.3.3+ds-21:2.3.3+ds-31:2.3.4+ds-11:2.3.4+ds-21:2.3.4+ds-31:2.3.5+ds-1 |
None known |
Show 11 moreShow less
| Package | Affected | Fixed |
|---|---|---|
numpyDebian:13 |
All versions, plus listed versions 1:2.2.4+ds-11:2.2.4+ds-1.11:2.2.4+ds-1.21:2.3.2+ds-11:2.3.3+ds-1 Show 18 moreShow less1:2.3.3+ds-21:2.3.3+ds-31:2.3.4+ds-11:2.3.4+ds-21:2.3.4+ds-31:2.3.5+ds-11:2.3.5+ds-21:2.3.5+ds-31:2.4.1+ds-11:2.4.2+ds-11:2.4.3+ds-11:2.4.4+ds-11:2.4.4+ds-21:2.4.6+ds-11:2.4.6+ds-21:2.4.6+ds-31:2.4.6+ds-41:2.4.6+ds-5 |
None known |
numpyDebian:14 |
All versions, plus listed versions 1:2.2.4+ds-11:2.2.4+ds-1.11:2.2.4+ds-1.21:2.3.2+ds-11:2.3.3+ds-1 Show 18 moreShow less1:2.3.3+ds-21:2.3.3+ds-31:2.3.4+ds-11:2.3.4+ds-21:2.3.4+ds-31:2.3.5+ds-11:2.3.5+ds-21:2.3.5+ds-31:2.4.1+ds-11:2.4.2+ds-11:2.4.3+ds-11:2.4.4+ds-11:2.4.4+ds-21:2.4.6+ds-11:2.4.6+ds-21:2.4.6+ds-31:2.4.6+ds-41:2.4.6+ds-5 |
None known |
numpyPyPI |
before 1.22, plus listed versions 0.9.60.9.81.01.0.31.0.4 Show 45 moreShow less1.0b11.0b41.0b51.0rc11.0rc21.0rc31.1.11.10.01.10.11.10.21.10.31.10.41.11.01.11.11.11.21.11.31.12.01.12.11.13.01.13.11.13.31.14.01.14.11.14.21.14.31.14.41.14.51.14.61.15.01.15.11.15.21.15.31.15.41.16.01.16.11.16.21.16.31.16.41.16.51.16.61.17.01.17.11.17.21.17.31.17.4 |
1.22 |
numpyopenEuler:20.03-LTS-SP1 From an advisory covering 2 CVEs |
before 1.16.5-6.oe1 | 1.16.5-6.oe1 |
numpyopenEuler:20.03-LTS-SP2 From an advisory covering 2 CVEs |
before 1.16.5-6.oe1 | 1.16.5-6.oe1 |
numpyopenEuler:20.03-LTS-SP3 From an advisory covering 2 CVEs |
before 1.16.5-6.oe1 | 1.16.5-6.oe1 |
numpyPyPI |
1.9.0 up to 1.10.0, plus listed versions 1.9.11.9.21.9.3 |
1.10.0 |
numpyUbuntu:20.04:LTS |
before 1:1.17.4-5ubuntu3.1, plus listed versions 1:1.17.3-0ubuntu21:1.17.4-3ubuntu11:1.17.4-3ubuntu21:1.17.4-5ubuntu21:1.17.4-5ubuntu3 |
1:1.17.4-5ubuntu3.1 |
numpyUbuntu:22.04:LTS |
before 1:1.21.5-1ubuntu22.04.1, plus listed versions 1:1.19.5-1ubuntu21:1.19.5-1ubuntu31:1.20.2-1ubuntu11:1.21.4-21:1.21.5-11:1.21.5-1build2 |
1:1.21.5-1ubuntu22.04.1 |
numpyUbuntu:20.04:LTS From an advisory covering 4 CVEs |
before 1:1.17.4-5ubuntu3.1, plus listed versions 1:1.17.3-0ubuntu21:1.17.4-3ubuntu11:1.17.4-3ubuntu21:1.17.4-5ubuntu21:1.17.4-5ubuntu3 |
1:1.17.4-5ubuntu3.1 |
numpyUbuntu:22.04:LTS From an advisory covering 4 CVEs |
before 1:1.21.5-1ubuntu22.04.1, plus listed versions 1:1.19.5-1ubuntu21:1.19.5-1ubuntu31:1.20.2-1ubuntu11:1.21.4-21:1.21.5-11:1.21.5-1build2 |
1:1.21.5-1ubuntu22.04.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases | OSV | |
| first indexed | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-34141 is a medium vulnerability (CVSS 5.3) in Numpy, published December 17, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.68%, the 77th percentile. Fixed in numpy 1.22.
References
github.com/numpy/numpy/issues/18993
oracle.com/security-alerts/cpujul2022.html
nvd.nist.gov/vuln/detail/CVE-2021-34141
security-tracker.debian.org/tracker/CVE-2021-34141
Show 10 moreShow less
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1522
ubuntu.com/security/CVE-2021-34141
cve.org/CVERecord?id=CVE-2021-34141
Left out here: 56 versions. The JSON record has them.