CVE-2017-12852

High

Published: 15/08/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The numpy.pad function in Numpy 1.13.1 and older versions is missing input validation. An empty list or ndarray can cause an infinite loop, allowing for a DoS attack.

Risk Assessment

The lack of input validation can lead to service disruption, affecting application availability and potentially being exploited by attackers.

Recommendation

It is recommended to update Numpy to the latest version to mitigate this vulnerability and implement input validation in the application.

Other vulnerabilities in Numpy

CVE-2021-34141Medium
An incomplete string comparison in the numpy.core component in NumPy before 1.22.0 allows attackers to trigger slightly incorrect copying by constructing specific string objects. NOTE: the vendor states that this reported code behavior is "completely harmless."

Original NVD description (English source)

The numpy.pad function in Numpy 1.13.1 and older versions is missing input validation. An empty list or ndarray will stick into an infinite loop, which can allow attackers to cause a DoS attack.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS