CVE-2026-95897

MediumCVSS 5.5

Published: 23/09/2026(UTC)Updated: 23/09/2026(UTC)Translated: 23/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.34%

27th percentile - higher than 27% of all known CVEs

Summary

Deserialization vulnerability in Dask up to 2026.8.0. Affects from_npy_stack in dask/array/core.py in Loader component. Remote attack, exploit public.

Risk Assessment

Possibility of executing malicious code on the server, potentially leading to data security breach.

Recommendation

Avoid loading untrusted data or use safe deserialization methods, and update Dask.

Other vulnerabilities in Dask

CVE-2026-10705Low
Dask up to version 3.0 has a vulnerability in the nunique_approx function in dask/dataframe/hyperloglog.py (HLL Handler component) that causes resource consumption. The attack is remote, with high complexity, and exploitation is difficult. A pull request with a fix is pending acceptance.

Original NVD description (English source)

A security vulnerability has been detected in Dask up to 2026.8.0. This affects the function from_npy_stack of the file dask/array/core.py of the component Loader. Such manipulation leads to deserialization. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS