CVE-2017-12852: DoS in NumPy ≤1.9.3

The primary impact of CVE-2017-12852 is a denial of service. An attacker can exploit this vulnerability by crafting malicious input – specifically, an empty list or NumPy ndarray – and passing it to the numpy.pad function. This triggers an infinite loop within the padding process, consuming excessive CPU resources and potentially freezing the application or system. The blast radius is dependent on the application's reliance on NumPy; any application using vulnerable versions is susceptible. While no direct data exfiltration is possible, the DoS can disrupt critical services and prevent legitimate users from accessing resources. This vulnerability is particularly concerning in environments where NumPy is used in high-performance computing or data processing pipelines.

1. Published2017-08-15
2. Modified2023-11-08
3. EPSS updated2026-04-02

The recommended mitigation for CVE-2017-12852 is to upgrade to NumPy version 1.13.3 or later, which includes the necessary input validation fix. If an immediate upgrade is not feasible due to compatibility issues or system downtime constraints, consider implementing temporary workarounds. One potential workaround involves validating the input to numpy.pad before calling the function, ensuring that it is not an empty list or ndarray. While not a complete solution, this can prevent the infinite loop. Monitor system resources (CPU usage) for unusual spikes that might indicate exploitation. After upgrading, confirm the fix by attempting to pad an empty array and verifying that the process completes without entering an infinite loop.