CVE-2021-41500

Incorrect Comparison in cvxopt

7.5 HighFix available

Incomplete string comparison vulnerability exits in cvxopt.org cvxop <= 1.2.6 in APIs (cvxopt.cholmod.diag, cvxopt.cholmod.getfactor, cvxopt.cholmod.solve, cvxopt.cholmod.spsolve), which allows attackers to conduct Denial of Service attacks by construct fake Capsule objects.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

1.19%Up 0.8 points since Dec 20, 2021

What each source reports

NVD Score used 7.5

Record: CVE-2021-41500
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness: CWE-697
Updated: 2026-11-02

CVE List No score

Record: CVE-2021-41500
Updated: 2026-11-02

EUVDEUVD-2021-0049 No score

Record: EUVD-2021-0049
Updated: 2026-11-03

GitHub AdvisoriesGHSA-8rh6-h94m-vj54 8.7

Incorrect Comparison in cvxopt

Record: GHSA-8rh6-h94m-vj54
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-697
Updated: 2026-11-02

OSV 7.5

Record: CVE-2021-41500
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2021-41500 7.5

Record: DEBIAN-CVE-2021-41500
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVGHSA-8rh6-h94m-vj54 8.7

Incorrect Comparison in cvxopt

Record: GHSA-8rh6-h94m-vj54
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-697
Updated: 2026-11-02

OSVUBUNTU-CVE-2021-41500 7.5

Record: UBUNTU-CVE-2021-41500
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVPYSEC-2021-870 No score

Record: PYSEC-2021-870
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`cvxopt` PyPI	before 1.2.7	1.2.7
`cvxopt` Debian:12	before 1.2.7+dfsg-1	1.2.7+dfsg-1
`cvxopt` Debian:13	before 1.2.7+dfsg-1	1.2.7+dfsg-1
`cvxopt` Debian:14	before 1.2.7+dfsg-1	1.2.7+dfsg-1
`cvxopt` PyPI	before 1.2.7, plus listed versions 1.1.61.1.71.1.81.1.91.2.0 Show 7 moreShow less 1.2.11.2.21.2.31.2.41.2.51.2.5.post11.2.6	1.2.7
`cvxopt` Ubuntu:14.04:LTS	All versions, plus listed versions 1.1.4-11.1.4-1.11.1.4-1.2	None known
`cvxopt` Ubuntu:16.04:LTS	All versions, plus listed versions 1.1.4-1.31.1.4-1.3build11.1.4-1.3build21.1.4-1.4	None known
`cvxopt` Ubuntu:18.04:LTS	All versions, plus listed versions 1.1.9+dfsg-21.1.9+dfsg-2build1	None known
`cvxopt` Ubuntu:20.04:LTS	All versions, plus listed versions 1.1.9+dfsg-3build21.2.3+dfsg-1ubuntu11.2.3+dfsg-21.2.3+dfsg-2build1	None known

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-41500 is a high vulnerability (CVSS 7.5) in Cvxopt Project Cvxopt, published December 17, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.19%, the 68th percentile. Fixed in cvxopt 1.2.7.

References

Show 5 moreShow less