Log in Start free

Vulnerability · Published Sep 23, 2026 · Assigned by VulDB

CVE-2026-95897Dask Loader core.py from_npy_stack deserialization

Medium 5.5

In plain English

A medium-severity unsafe deserialization in Dask. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.2%top 91.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A security vulnerability has been detected in Dask up to 2026.8.0. This affects the function from_npy_stack of the file dask/array/core.py of the component Loader. Such manipulation leads to deserialization. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12daskno fix listedDEBIAN-CVE-2026-95897
Debian:13daskno fix listedDEBIAN-CVE-2026-95897
Debian:14daskno fix listedDEBIAN-CVE-2026-95897
Ubuntu:22.04:LTSdaskno fix listedUBUNTU-CVE-2026-95897
Ubuntu:24.04:LTSdaskno fix listedUBUNTU-CVE-2026-95897
Ubuntu:26.04:LTSdaskno fix listedUBUNTU-CVE-2026-95897
Ubuntu:26.10daskno fix listedUBUNTU-CVE-2026-95897

Affected products (as reported)

VendorProductVersions
n/a Dask 2026.02026.12026.22026.32026.42026.52026.62026.7

Weakness: CWE-502, CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References