CVE-2026-10705: dask HLL hyperloglog.py nunique_approx resource consumption
A flaw has been found in dask up to 3.0. Affected by this issue is the function nuniqueapprox of the file dask/dataframe/hyperloglog.py of the component HLL Handler. This manipulation causes resource consumption. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. The exploitation is known to be difficult. The pull request to fix this issue awaits acceptance.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10705?
The severity of CVE-2026-10705 is rated as low, with a score of 3.1.
How does CVE-2026-10705 impact resource consumption in dask?
CVE-2026-10705 affects the nunique_approx function in dask, leading to excessive resource consumption during execution.
Can CVE-2026-10705 be exploited remotely?
Yes, CVE-2026-10705 can be exploited remotely due to its nature as a flaw in the dask HLL Handler.
What versions of dask are affected by CVE-2026-10705?
CVE-2026-10705 affects dask versions up to 3.0.
What is a possible mitigation for CVE-2026-10705?
Mitigation strategies for CVE-2026-10705 include upgrading to a version of dask that addresses the vulnerability.