Executive brief
Dask, a library for parallel computing in Python, contains a flaw in how it handles data partitioning and unique value estimation. An attacker could potentially provide specially crafted data that causes the system to consume excessive resources, leading to performance degradation or a denial-of-service condition. This could impact the availability of data processing pipelines and increase operational costs.
Technical details
A resource consumption vulnerability exists in Dask's HyperLogLog (HLL) implementation and shuffle routing logic. The `nunique_approx` function in `dask/dataframe/hyperloglog.py` truncates 64-bit pandas hashes to 32-bit, increasing collision rates. Furthermore, Dask relies on `pd.util.hash_pandas_object`, which is deterministic and not collision-resistant. A remote attacker with the ability to provide input data can craft keys that concentrate in a single target partition (hash collision attack), leading to significant data skew and resource exhaustion. A fix has been proposed in pull request #12401 which preserves full 64-bit hashes and introduces a configurable hash key for shuffle operations.
Affected products
- Dask Dask up to 3.0
Timeline
- 2026-05-16: other: Issue reported on GitHub and fix proposed via pull request
- 2026-06-03: disclosed: Vulnerability published in NVD