CVE-2021-41496 Buffer Copy without Checking Size of Input in NumPy

What is CVE-2021-41496?

CVE-2021-41496 is a medium-severity denial of service vulnerability in n/a, published on 17 Dec 2021. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Buffer overflow in the array_from_pyobj function of fortranobject.c in NumPy < 1.19, which allows attackers to conduct a Denial of Service attacks by carefully constructing an array with negative values. NOTE: The vendor does not agree this is a vulnerability; the negative dimensions can only be created by an already privileged user (or internally)

Weakness: CWE-120

Which versions are affected by CVE-2021-41496?

3 open source packages ship an affected version, including numpy. It affects 1 product.

Products include Numpy Numpy.

How do I fix CVE-2021-41496?

Upgrade numpy to a fixed version for your release line: 1.19 or 1.19.0.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2021-41496 being exploited?

There is no known exploitation of CVE-2021-41496 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2017-12852 Numpy missing input validation High 7.5
• CVE-2014-1858 Arbitrary file write in NumPy Medium 5.5
• CVE-2021-33430 NumPy Buffer Overflow (Disputed) Medium 5.3
• CVE-2021-34141 Incorrect Comparison in NumPy Medium 5.3
• CVE-2021-41495 NumPy NULL Pointer Dereference Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as AZL-7056, CLSA-2025-1766621635, CLSA-2026-1791368060, DEBIAN-CVE-2021-41496, ECHO-70fc-d0bb-2f7d, GHSA-f7c7-j99h-c22f and 4 more.