{"id":"CVE-2017-12852","aliases":["EUVD-2017-0080","GHSA-frgw-fgh6-9g52","PYSEC-2017-1","SUSE-RU-2017:3010-1","SUSE-SU-2022:3954-1","UBUNTU-CVE-2017-12852","openSUSE-SU-2024:11243-1","openSUSE-SU-2024:13820-1","openSUSE-SU-2024:14311-1","openSUSE-SU-2026:11371-1"],"status":"published","title":"Numpy missing input validation","description":"The numpy.pad function in Numpy 1.13.1 and older versions is missing input validation. An empty list or ndarray will stick into an infinite loop, which can allow attackers to cause a DoS attack.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.02737,"percentile":0.86211,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-835"],"published":"2017-08-15T16:00:00Z","modified":"2026-10-20T10:48:12Z","exploits":[{"source":"pocgithub","id":"BT123/numpy-1.13.1","title":"BT123/numpy-1.13.1","date":"2017-09-30","url":"https://github.com/BT123/numpy-1.13.1"}],"fixes":[{"ecosystem":"PyPI","package":"numpy","fixed_in":["1.13.3"],"sources":["ghsa","osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for HPC 12","package":"python-numpy_1_13_3-gnu-hpc","fixed_in":["1.13.3-4.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"python-numpy","fixed_in":["1.8.0-5.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"python-numpy","fixed_in":["1.8.0-5.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"python-numpy","fixed_in":["1.8.0-5.19.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"numpy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.3"}]}]},{"source":"osv","ecosystem":"PyPI","package":"numpy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.3"}]}],"versions":["0.9.6","0.9.8","1.0","1.0.3","1.0.4","1.0b1","1.0b4","1.0b5","1.0rc1","1.0rc2","1.0rc3","1.1.1","1.10.0","1.10.1","1.10.2","1.10.3","1.10.4","1.11.0","1.11.1","1.11.2","1.11.3","1.12.0","1.12.1","1.13.0","1.13.1","1.2.0","1.2.1","1.3.0","1.4.0","1.4.1","1.5.0","1.5.1","1.6.0","1.6.1","1.6.2","1.7.0","1.7.1","1.7.2","1.8.0","1.8.1","1.8.2","1.9.0","1.9.1","1.9.2","1.9.3"]},{"source":"osv","ecosystem":"PyPI","package":"numpy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.3"}]}],"versions":["0.9.6","0.9.8","1.0","1.0.3","1.0.4","1.0b1","1.0b4","1.0b5","1.0rc1","1.0rc2","1.0rc3","1.1.1","1.10.0","1.10.1","1.10.2","1.10.3","1.10.4","1.11.0","1.11.1","1.11.2","1.11.3","1.12.0","1.12.1","1.13.0","1.13.0rc1","1.13.0rc2","1.13.1","1.2.0","1.2.1","1.3.0","1.4.0","1.4.1","1.5.0","1.5.1","1.6.0","1.6.1","1.6.2","1.7.0","1.7.1","1.7.2","1.8.0","1.8.1","1.8.2","1.9.0","1.9.1","1.9.2","1.9.3"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for HPC 12","package":"python-numpy_1_13_3-gnu-hpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.3-4.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"python-numpy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-5.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"python-numpy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-5.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"python-numpy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-5.19.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"python-numpy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.8.2-1ubuntu2","1:1.8.2-1ubuntu3","1:1.10.4-2ubuntu2","1:1.11.0-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"python-numpy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.12.1-3.1ubuntu4","1:1.13.3-0ubuntu1","1:1.13.3-1ubuntu1","1:1.13.3-1ubuntu2","1:1.13.3-2ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-numpy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.2-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-numpy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.2-5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-numpy1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.4-1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-numpy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.6-1.1"}]}],"bundled":5}],"products":[{"vendor":"numpy","product":"numpy"}],"references":[{"url":"https://github.com/BT123/testcasesForMyRequest/tree/master/CVE-2017-12852","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://github.com/numpy/numpy/issues/9560#issuecomment-322395292","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Third Party Advisory","evidence","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-12852","tags":["advisory"]},{"url":"https://github.com/numpy/numpy/releases/tag/v1.13.3","tags":["web"]},{"url":"https://github.com/advisories/GHSA-frgw-fgh6-9g52","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/numpy/PYSEC-2017-1.yaml","tags":["web"]},{"url":"https://github.com/numpy/numpy","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement//suse-ru-20173010-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1053963","tags":["report"]},{"url":"https://bugzilla.suse.com/1066748","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12852","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223954-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1199500","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-12852","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-12852","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6446","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33430","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41495","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41496","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-12852","description":"The numpy.pad function in Numpy 1.13.1 and older versions is missing input validation. An empty list or ndarray will stick into an infinite loop, which can allow attackers to cause a DoS attack.","status":"published","published":"2017-08-15T16:00:00Z","modified":"2024-08-05T18:51:06.687Z","updated_at":"2026-11-02T14:33:17.264801Z"}],"euvd":[{"id":"EUVD-2017-0080","description":"The numpy.pad function in Numpy 1.13.1 and older versions is missing input validation. An empty list or ndarray will stick into an infinite loop, which can allow attackers to cause a DoS attack.","status":"published","published":"2017-08-15T16:00:00Z","modified":"2024-08-05T18:51:06Z","updated_at":"2026-11-03T02:23:20.716903Z"}],"ghsa":[{"id":"GHSA-frgw-fgh6-9g52","title":"Numpy missing input validation","description":"The numpy.pad function in Numpy 1.13.1 and older versions is missing input validation. An empty list or ndarray will stick into an infinite loop, which can allow attackers to cause a DoS attack.","status":"published","published":"2022-05-13T01:42:46Z","modified":"2023-01-27T05:07:54Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:36:22.592333Z"}],"nvd":[{"id":"CVE-2017-12852","description":"The numpy.pad function in Numpy 1.13.1 and older versions is missing input validation. An empty list or ndarray will stick into an infinite loop, which can allow attackers to cause a DoS attack.","status":"published","published":"2017-08-15T16:29:00.2Z","modified":"2026-06-17T01:04:01.7Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:03:57.82609Z"}],"osv":[{"id":"CVE-2017-12852","description":"The numpy.pad function in Numpy 1.13.1 and older versions is missing input validation. An empty list or ndarray will stick into an infinite loop, which can allow attackers to cause a DoS attack.","status":"published","published":"2017-08-15T16:29:00.2Z","modified":"2026-10-20T10:48:12.434692673Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:04.159616Z"},{"id":"GHSA-frgw-fgh6-9g52","title":"Numpy missing input validation","description":"The numpy.pad function in Numpy 1.13.1 and older versions is missing input validation. An empty list or ndarray will stick into an infinite loop, which can allow attackers to cause a DoS attack.","status":"published","published":"2022-05-13T01:42:46Z","modified":"2023-11-08T03:58:54.336802Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T15:46:46.760785Z"},{"id":"UBUNTU-CVE-2017-12852","description":"The numpy.pad function in Numpy 1.13.1 and older versions is missing input validation. An empty list or ndarray will stick into an infinite loop, which can allow attackers to cause a DoS attack.","status":"published","published":"2017-08-15T16:29:00Z","modified":"2025-10-24T04:46:27Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:14.122973Z"},{"id":"openSUSE-SU-2024:11243-1","title":"python38-numpy-1.21.2-1.1 on GA media","description":"These are all security issues fixed in the python38-numpy-1.21.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:55:53.096275Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"openSUSE-SU-2024:13820-1","title":"python310-numpy-1.26.2-5.1 on GA media","description":"These are all security issues fixed in the python310-numpy-1.26.2-5.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:59:08.78178Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"openSUSE-SU-2024:14311-1","title":"python310-numpy1-1.26.4-1.1 on GA media","description":"These are all security issues fixed in the python310-numpy1-1.26.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-09-04T00:00:00Z","modified":"2026-02-04T02:59:21.451315Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2026:11371-1","title":"python313-numpy-2.4.6-1.1 on GA media","description":"These are all security issues fixed in the python313-numpy-2.4.6-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-24T00:00:00Z","modified":"2026-07-25T18:24:27.807636812Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"PYSEC-2017-1","description":"The numpy.pad function in Numpy 1.13.1 and older versions is missing input validation. An empty list or ndarray will stick into an infinite loop, which can allow attackers to cause a DoS attack.","status":"published","published":"2017-08-15T16:29:00Z","modified":"2023-11-08T03:58:54.336802Z","updated_at":"2026-11-02T15:52:51.645172Z"},{"id":"SUSE-RU-2017:3010-1","title":"Initial release of python-numpy for HPC (v1.13.3, gcc)","description":"\n  \nThis update introduces the NumPy packages version 1.13.3 built for \nenvironment modules to the HPC (module FATE#321709).\n\nNumPy is a general-purpose array-processing package for Python designed to\nmanipulate large multi-dimensional arrays of arbitrary records.\n\nIt also provides basic facilities for discrete fourier transform,\nbasic linear algebra and random number generation.\n\n","status":"published","published":"2017-11-14T06:28:00Z","modified":"2026-02-04T04:34:56.356329Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2022:3954-1","title":"Security update for python-numpy","description":"This update for python-numpy fixes the following issues:\n\n  - CVE-2017-12852: Fixed missing input validation leading to infinite loops (bsc#1053963).\n\n  Bugfixes:\n  - Use update-alternatives for /usr/bin/f2py (bsc#1199500).\n","status":"published","published":"2022-11-11T11:03:07Z","modified":"2025-05-02T04:29:43.610444Z","updated_at":"2026-11-02T15:53:51.440565Z"}]}}