CVE-2026-10705: dask HLL hyperloglog.py nunique_approx resource consumption

Severity: low (CVSS 3.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-03 · updated 2026-07-22
Weakness: CWE-400

Description

A flaw has been found in dask up to 3.0. Affected by this issue is the function nunique_approx of the file dask/dataframe/hyperloglog.py of the component HLL Handler. This manipulation causes resource consumption. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. The exploitation is known to be difficult. The pull request to fix this issue awaits acceptance.

Affected products

dask: 3.0

References

https://github.com/dask/dask/
https://github.com/dask/dask/issues/12403
https://github.com/dask/dask/pull/12401
https://vuldb.com/cve/CVE-2026-10705
https://vuldb.com/submit/831411
https://vuldb.com/vuln/368018
https://vuldb.com/vuln/368018/cti

Get alerted when CVE-2026-10705 or the next vulnerability affects your stack