CVE-2026-10705
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
Dask up to version 3.0 has a vulnerability in the nunique_approx function in dask/dataframe/hyperloglog.py (HLL Handler component) that causes resource consumption. The attack is remote, with high complexity, and exploitation is difficult. A pull request with a fix is pending acceptance.
Risk Assessment
An attacker can cause resource exhaustion, leading to denial of service (DoS) for applications using Dask.
Recommendation
Monitor the fix progress and apply temporary mitigations such as restricting access to the nunique_approx function.
Original NVD description (English source)
A flaw has been found in dask up to 3.0. Affected by this issue is the function nunique_approx of the file dask/dataframe/hyperloglog.py of the component HLL Handler. This manipulation causes resource consumption. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. The exploitation is known to be difficult. The pull request to fix this issue awaits acceptance.