CVE-2021-34141

MediumCVSS 5.3

Published: 17/12/2021(UTC)Updated: 08/10/2026(UTC)Translated: 09/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.56%

75th percentile - higher than 75% of all known CVEs

Summary

An incomplete string comparison in the numpy.core component in NumPy before 1.22.0 allows attackers to trigger slightly incorrect copying by constructing specific string objects. NOTE: the vendor states that this reported code behavior is "completely harmless."

Risk Assessment

Although the vendor considers it harmless, it could potentially lead to unexpected application behavior in rare cases.

Recommendation

Update NumPy to version 1.22.0 or later.

Other vulnerabilities in NumPy

CVE-2017-12852High
The numpy.pad function in Numpy 1.13.1 and older versions is missing input validation. An empty list or ndarray can cause an infinite loop, allowing for a DoS attack.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS