Every CVE Search/ Get API key

CVE-2023-25399

Withdrawn: scipy memory leak vulnerability

5.5 MediumFix availableDisputed

A refcounting issue which leads to potential memory leak was discovered in scipy commit 8627df31ab in Py_FindObjects() function. Note: This is disputed as a bug and not a vulnerability. SciPy is not designed to be exposed to untrusted users or data directly.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.38%Up 0.3 points since Jul 6, 2023
90%50%10%1%

What each source reports

NVD Score used 5.5

A refcounting issue which leads to potential memory leak was discovered in scipy commit 8627df31ab in Py_FindObjects() function. Note: This is disputed as a bug and not a vulnerability. SciPy is not designed to be exposed to untrusted users or data directly.

Record
CVE-2023-25399
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-401
Updated
2026-11-02
CVE List 5.5

A refcounting issue which leads to potential memory leak was discovered in scipy commit 8627df31ab in Py_FindObjects() function. Note: This is disputed as a bug and not a vulnerability. SciPy is not designed to be exposed to untrusted users or data directly.

Record
CVE-2023-25399
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-401
Updated
2026-11-02
EUVDEUVD-2023-0234 5.5

A refcounting issue which leads to potential memory leak was discovered in scipy commit 8627df31ab in Py_FindObjects() function. Note: This is disputed as a bug and not a vulnerability. SciPy is not designed to be exposed to untrusted users or data directly.

Record
EUVD-2023-0234
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-03
GitHub AdvisoriesGHSA-9jx5-6pgf-crrp 5.5

Withdrawn: scipy memory leak vulnerability

Withdrawn Advisory

This advisory has been withdrawn because it has been found to not be an issue. Please see the issue here for more information.

Original Description

A refcounting issue which leads to potential memory leak was discovered in scipy commit 8627df31ab in Py_FindObjects() function.

Record
GHSA-9jx5-6pgf-crrp
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
OSV 5.5

A refcounting issue which leads to potential memory leak was discovered in scipy commit 8627df31ab in Py_FindObjects() function. Note: This is disputed as a bug and not a vulnerability. SciPy is not designed to be exposed to untrusted users or data directly.

Record
CVE-2023-25399
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2023-25399 5.5

A refcounting issue which leads to potential memory leak was discovered in scipy commit 8627df31ab in Py_FindObjects() function. Note: This is disputed as a bug and not a vulnerability. SciPy is not designed to be exposed to untrusted users or data directly.

Record
DEBIAN-CVE-2023-25399
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 8 moreShow less
OSVGHSA-9jx5-6pgf-crrp 5.5

Withdrawn: scipy memory leak vulnerability

Withdrawn Advisory

This advisory has been withdrawn because it has been found to not be an issue. Please see the issue here for more information.

Original Description

A refcounting issue which leads to potential memory leak was discovered in scipy commit 8627df31ab in Py_FindObjects() function.

Record
GHSA-9jx5-6pgf-crrp
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
OSVOESA-2023-1491 5.5

scipy security update

SciPy (pronounced "Sigh Pie") is open-source software for mathematics, science, and engineering. It includes modules for statistics, optimization, integration, linear algebra, Fourier transforms, signal and image processing, ODE solvers, and more.

Security Fix(es):

A refcounting issue which leads to potential memory leak was discovered in scipy commit 8627df31ab in Py_FindObjects() function.(CVE-2023-25399)

Record
OESA-2023-1491
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2023-25399 5.5

A refcounting issue which leads to potential memory leak was discovered in scipy commit 8627df31ab in Py_FindObjects() function. Note: This is disputed as a bug and not a vulnerability. SciPy is not designed to be exposed to untrusted users or data directly.

Record
UBUNTU-CVE-2023-25399
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVMGASA-2024-0078 No score

Updated python-scipy packages fix security vulnerability

A refcounting issue which leads to potential memory leak was discovered in scipy commit 8627df31ab in Py_FindObjects() function. (CVE-2023-25399

Record
MGASA-2024-0078
Updated
2026-11-02
OSVPYSEC-2023-102 No score

A refcounting issue which leads to potential memory leak was discovered in scipy commit 8627df31ab in Py_FindObjects() function.

Record
PYSEC-2023-102
Updated
2026-11-02
OSVSUSE-SU-2023:2970-1 No score

Security update for python-scipy

This update for python-scipy fixes the following issues:

  • CVE-2023-25399: Fixed minor refcounting issue in Py_FindObjects (bsc#1213062).
  • CVE-2023-29824: Fixed use-after-free in Py_FindObjects (bsc#1213137).
Record
SUSE-SU-2023:2970-1
Updated
2026-11-02
OSVSUSE-SU-2023:3272-1 No score

Security update for python-scipy

This update for python-scipy fixes the following issues:

  • CVE-2023-25399: Fixed minor refcounting issue in Py_FindObjects (bsc#1213062).
  • CVE-2023-29824: Fixed use-after-free in Py_FindObjects (bsc#1213137).
Record
SUSE-SU-2023:3272-1
Updated
2026-11-02
OSVUSN-6226-1 No score

scipy vulnerabilities

It was discovered that SciPy did not properly manage memory operations during reference counting. An attacker could possibly use this issue to cause a denial of service. (CVE-2023-25399)

A use-after-free was discovered in SciPy when handling reference counts. An attacker could possibly use this to cause a denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2023-29824)

Record
USN-6226-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
scipy
Debian:12
 before 1.10.0-2
1.10.0-2
scipy
Debian:13
 before 1.10.0-2
1.10.0-2
scipy
Debian:14
 before 1.10.0-2
1.10.0-2
python-scipy
Mageia:9
 before 1.9.1-2.1.mga9
1.9.1-2.1.mga9
scipy
openEuler:20.03-LTS-SP1
 before 1.2.2-4.oe1
1.2.2-4.oe1
scipy
openEuler:20.03-LTS-SP3
 before 1.2.2-4.oe1
1.2.2-4.oe1
scipy
openEuler:22.03-LTS
 before 1.6.2-2.oe2203sp2
1.6.2-2.oe2203sp2
scipy
openEuler:22.03-LTS-SP1
 before 1.6.2-2.oe2203sp1
1.6.2-2.oe2203sp1
scipy
openEuler:22.03-LTS-SP2
 before 1.6.2-2.oe2203sp2
1.6.2-2.oe2203sp2
scipy
PyPI
 before 1.10.0, plus listed versions
0.10.00.10.10.11.00.12.00.12.1
Show 45 moreShow less
0.13.00.13.10.13.20.13.30.14.00.14.10.15.00.15.10.16.00.16.10.17.00.17.10.18.00.18.10.19.00.19.10.4.40.5.20.6.00.7.00.7.20.8.00.9.01.0.01.0.11.1.01.10.0rc11.10.0rc21.2.01.2.11.2.21.2.31.3.01.3.11.3.21.3.31.4.01.4.11.5.01.5.11.5.21.5.31.5.41.6.01.6.1
1.10.0
Show 15 moreShow less
Affected packages
PackageAffectedFixed
python-scipy
openSUSE:Leap 15.4
From an advisory covering 2 CVEs
 before 1.2.0-150100.4.6.1
1.2.0-150100.4.6.1
python-scipy_1_2_0-gnu-hpc
openSUSE:Leap 15.4
From an advisory covering 2 CVEs
 before 1.2.0-150100.4.6.1
1.2.0-150100.4.6.1
python-scipy_1_2_0-gnu-hpc
openSUSE:Leap 15.5
From an advisory covering 2 CVEs
 before 1.2.0-150100.4.6.1
1.2.0-150100.4.6.1
python-scipy_1_3_3-gnu-hpc
SUSE:Linux Enterprise Module for HPC 15 SP4
From an advisory covering 2 CVEs
 before 1.3.3-150200.5.3.1
1.3.3-150200.5.3.1
python-scipy_1_3_3-gnu-hpc
SUSE:Linux Enterprise Module for HPC 15 SP5
From an advisory covering 2 CVEs
 before 1.3.3-150200.5.3.1
1.3.3-150200.5.3.1
python-scipy
SUSE:Linux Enterprise Module for Package Hub 15 SP4
From an advisory covering 2 CVEs
 before 1.3.3-150200.5.3.1
1.3.3-150200.5.3.1
python-scipy
SUSE:Linux Enterprise Module for Package Hub 15 SP5
From an advisory covering 2 CVEs
 before 1.3.3-150200.5.3.1
1.3.3-150200.5.3.1
python-scipy_1_3_3-gnu-hpc
SUSE:Linux Enterprise Module for Package Hub 15 SP5
From an advisory covering 2 CVEs
 before 1.3.3-150200.5.3.1
1.3.3-150200.5.3.1
python-scipy
openSUSE:Leap 15.4
From an advisory covering 2 CVEs
 before 1.3.3-150200.5.3.1
1.3.3-150200.5.3.1
python-scipy_1_3_3-gnu-hpc
openSUSE:Leap 15.4
From an advisory covering 2 CVEs
 before 1.3.3-150200.5.3.1
1.3.3-150200.5.3.1
python-scipy
openSUSE:Leap 15.5
From an advisory covering 2 CVEs
 before 1.3.3-150200.5.3.1
1.3.3-150200.5.3.1
python-scipy_1_3_3-gnu-hpc
openSUSE:Leap 15.5
From an advisory covering 2 CVEs
 before 1.3.3-150200.5.3.1
1.3.3-150200.5.3.1
scipy
Ubuntu:Pro:22.04:LTS
 before 1.8.0-1exp2ubuntu1+esm1, plus listed versions
1.6.0-21.7.1-1ubuntu11.8.0-1exp2ubuntu1
1.8.0-1exp2ubuntu1+esm1
scipy
Ubuntu:Pro:20.04:LTS
From an advisory covering 2 CVEs
 before 1.3.3-3ubuntu0.1~esm1, plus listed versions
1.3.3-31.3.3-3build1
1.3.3-3ubuntu0.1~esm1
scipy
Ubuntu:Pro:22.04:LTS
From an advisory covering 2 CVEs
 before 1.8.0-1exp2ubuntu1+esm1, plus listed versions
1.6.0-21.7.1-1ubuntu11.8.0-1exp2ubuntu1
1.8.0-1exp2ubuntu1+esm1

History

History
RecordedChangedSources
affected, facts
affected
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-25399 is a medium vulnerability (CVSS 5.5) in Scipy, published July 5, 2023. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 0.38%, the 32nd percentile. Fixed in scipy 1.10.0-2.

References

Show 17 moreShow less
This page doesn't list everything

Left out here: 19 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open