CVE-2026-10705 in dask
Summary
by MITRE • 06/03/2026
A flaw has been found in dask up to 3.0. Affected by this issue is the function nunique_approx of the file dask/dataframe/hyperloglog.py of the component HLL Handler. This manipulation causes resource consumption. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. The exploitation is known to be difficult. The pull request to fix this issue awaits acceptance.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 06/07/2026
The vulnerability identified in dask version 3.0 and earlier affects the nunique_approx function within the hyperloglog.py file, specifically within the HLL Handler component. This flaw represents a resource consumption issue that can be exploited remotely, making it particularly concerning for systems that process large datasets or operate in networked environments. The vulnerability resides in the hyperloglog implementation which is designed to provide approximate cardinality estimation for dataframes, a common requirement in big data processing workflows.
The technical nature of this vulnerability stems from improper resource management within the nunique_approx function that handles hyperloglog operations. When processing certain input data patterns, the function may consume excessive memory or processing resources, potentially leading to denial of service conditions. The attack complexity is classified as high, indicating that exploitation requires significant expertise and resources, though the remote execution capability means that attackers do not need physical access to the target system. This characteristic places the vulnerability in the category of remotely exploitable issues that can be leveraged by threat actors without direct system access.
The operational impact of this vulnerability extends beyond simple resource exhaustion, as it can disrupt data processing workflows and potentially affect the availability of services that depend on dask for distributed computing tasks. Organizations using dask for data analysis, machine learning pipelines, or large-scale data processing may experience performance degradation or complete service interruption when this vulnerability is exploited. The issue affects the core HLL Handler functionality, which means that any application relying on approximate cardinality estimation for dataframes could be impacted, particularly in high-throughput environments where multiple concurrent operations occur.
From a security perspective, this vulnerability aligns with CWE-400 which covers "Uncontrolled Resource Consumption" and potentially CWE-770 for "Allocation of Resources Without Limits or Throttling" depending on the specific implementation details. The attack surface follows ATT&CK technique T1499.004 for "Resource Hijacking" where adversaries may consume system resources to degrade performance or availability. Organizations should prioritize updating to the fixed version once the pull request is accepted and reviewed, implementing monitoring for unusual resource consumption patterns, and considering temporary mitigations such as input validation or rate limiting for hyperloglog operations until the official patch is deployed. The high attack complexity suggests that while exploitation is not trivial, the potential impact makes it a critical issue requiring immediate attention from security teams responsible for maintaining data processing infrastructure.