CVE-2026-10705
dask HLL hyperloglog.py nunique_approx resource consumption
A flaw has been found in dask up to 3.0. Affected by this issue is the function nunique_approx of the file dask/dataframe/hyperloglog.py of the component HLL Handler. This manipulation causes resource consumption. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. The exploitation is known to be difficult. The pull request to fix this issue awaits acceptance.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
dask HLL hyperloglog.py nunique_approx resource consumption
A flaw has been found in dask up to 3.0. Affected by this issue is the function nunique_approx of the file dask/dataframe/hyperloglog.py of the component HLL Handler. This manipulation causes resource consumption. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. The exploitation is known to be difficult. The pull request to fix this issue awaits acceptance.
- Record
CVE-2026-10705- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X - CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:R - CVSS 3.0
- 3.1 Low
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:R - CVSS 2.0
- 2.1
AV:N/AC:H/Au:S/C:N/I:N/A:P/E:ND/RL:ND/RC:UR - Weakness
- CWE-400, CWE-404
- Updated
- 2026-11-02
EUVDEUVD-2026-34064
A flaw has been found in dask up to 3.0. Affected by this issue is the function nunique_approx of the file dask/dataframe/hyperloglog.py of the component HLL Handler. This manipulation causes resource consumption. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. The exploitation is known to be difficult. The pull request to fix this issue awaits acceptance.
- Record
EUVD-2026-34064- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-qp9q-4rh4-m8jc
A flaw has been found in dask up to 3.0. Affected by this issue is the function nunique_approx of...
A flaw has been found in dask up to 3.0. Affected by this issue is the function nunique_approx of the file dask/dataframe/hyperloglog.py of the component HLL Handler. This manipulation causes resource consumption. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. The exploitation is known to be difficult. The pull request to fix this issue awaits acceptance.
- Record
GHSA-qp9q-4rh4-m8jc- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-400
- Updated
- 2026-11-02
NVD
A flaw has been found in dask up to 3.0. Affected by this issue is the function nunique_approx of the file dask/dataframe/hyperloglog.py of the component HLL Handler. This manipulation causes resource consumption. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. The exploitation is known to be difficult. The pull request to fix this issue awaits acceptance.
- Record
CVE-2026-10705- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L - CVSS 2.0
- 2.1 Low
AV:N/AC:H/Au:S/C:N/I:N/A:P - Weakness
- CWE-400, CWE-404
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-10705
A flaw has been found in dask up to 3.0. Affected by this issue is the function nunique_approx of the file dask/dataframe/hyperloglog.py of the component HLL Handler. This manipulation causes resource consumption. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. The exploitation is known to be difficult. The pull request to fix this issue awaits acceptance.
- Record
DEBIAN-CVE-2026-10705- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-10705
A flaw has been found in dask up to 3.0. Affected by this issue is the function nunique_approx of the file dask/dataframe/hyperloglog.py of the component HLL Handler. This manipulation causes resource consumption. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. The exploitation is known to be difficult. The pull request to fix this issue awaits acceptance.
- Record
UBUNTU-CVE-2026-10705- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
daskDebian:12 |
All versions, plus listed versions 2022.12.1+dfsg-22023.12.1+dfsg-12023.12.1+dfsg-22023.8.0+dfsg-12023.8.0+dfsg-2 Show 7 moreShow less2024.1.1+dfsg-12024.12.1+dfsg-12024.12.1+dfsg-22024.12.1+dfsg-32024.12.1+dfsg-42024.12.1+dfsg-62024.5.2+dfsg-1 |
None known |
daskDebian:13 |
All versions, plus listed versions 2024.12.1+dfsg-22024.12.1+dfsg-32024.12.1+dfsg-42024.12.1+dfsg-6 |
None known |
daskDebian:14 |
All versions, plus listed versions 2024.12.1+dfsg-22024.12.1+dfsg-32024.12.1+dfsg-42024.12.1+dfsg-6 |
None known |
daskUbuntu:18.04:LTS |
All versions, plus listed versions 0.15.1-30.15.4-10.16.0-1 |
None known |
daskUbuntu:20.04:LTS |
All versions, plus listed versions 1.0.0+dfsg-22.8.0-0ubuntu42.8.1+dfsg-0.2ubuntu12.8.1+dfsg-0.32.8.1+dfsg-0.4 |
None known |
daskUbuntu:22.04:LTS |
All versions, plus listed versions 2021.01.0+dfsg-1ubuntu12021.09.1+dfsg-1ubuntu12021.09.1+dfsg-1ubuntu22022.01.0+dfsg-12022.01.0+dfsg-1ubuntu1 |
None known |
daskUbuntu:24.04:LTS |
All versions, plus listed versions 2023.8.0+dfsg-22023.12.1+dfsg-2 |
None known |
daskUbuntu:25.10 |
All versions, plus listed versions 2024.12.1+dfsg-2 |
None known |
daskUbuntu:26.10 |
All versions, plus listed versions 2024.12.1+dfsg-2build12024.12.1+dfsg-32024.12.1+dfsg-4 |
None known |
daskUbuntu:26.04:LTS |
All versions, plus listed versions 2024.12.1+dfsg-22024.12.1+dfsg-2build1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-10705 is a low vulnerability (CVSS 2.3) in dask, published June 3, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.29%, the 21st percentile. No source names a fixed version.