CVE catalog

CVE-2021-41495

numpy: CVE-2021-41495

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
1.24% · Oct 27, 2026

Null Pointer Dereference vulnerability exists in numpy.sort in NumPy &lt and 1.19 in the PyArray_DescrNew function due to missing return-value validation, which allows attackers to conduct DoS attacks by repetitively creating sort arrays. NOTE: While correct that validation is missing, an error can only occur due to an exhaustion of memory. If the user can exhaust memory, they are already privileged. Further, it should be practically impossible to construct an attack which can target the memory exhaustion to occur at exactly this place

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiannumpysid1:2.4.6+ds-5vulnerable
Debiannumpyforky1:2.4.6+ds-5vulnerable
Debiannumpytrixie1:2.2.4+ds-1vulnerable
Debiannumpybookworm1:1.24.2-1+deb12u1vulnerable
Susepython-numpylinux enterprise software development kit 12 sp51.8.0-5.14.1fixed
Susepython-numpylinux enterprise server 12 sp51.8.0-5.14.1fixed
Susepython-numpylinux enterprise server for sap applications 12 sp51.8.0-5.14.1fixed
Susepython-numpylinux enterprise module for basesystem 15 sp41.17.3-150400.23.3.1fixed
Susepython-numpy_1_17_3-gnu-hpclinux enterprise module for hpc 15 sp41.17.3-150400.23.3.1fixed
Opensusepython-numpyleap 15.41.17.3-150400.23.3.1fixed
Opensusepython-numpy_1_17_3-gnu-hpcleap 15.41.17.3-150400.23.3.1fixed
Susepython3-numpylinux enterprise module for basesystem 15 sp61.17.3-150400.31.1fixed
Susepython-numpy_1_17_3-gnu-hpclinux enterprise module for hpc 15 sp61.17.3-150400.31.1fixed
Susepython-numpy_1_17_3-gnu-hpclinux enterprise module for package hub 15 sp61.17.3-150400.31.1fixed
Opensusepython-numpy_1_17_3-gnu-hpcleap 15.61.17.3-150400.31.1fixed
Opensusepython3-numpyleap 15.61.17.3-150400.31.1fixed
Ubuntunumpy20.041:1.17.3-0ubuntu2vulnerable
Ubuntunumpy20.041:1.17.4-3ubuntu1vulnerable
Ubuntunumpy20.041:1.17.4-3ubuntu2vulnerable
Ubuntunumpy20.041:1.17.4-5ubuntu2vulnerable
Ubuntunumpy20.041:1.17.4-5ubuntu3vulnerable
Ubuntunumpy20.041:1.17.4-5ubuntu3.1fixed
Ubuntunumpy22.041:1.19.5-1ubuntu2vulnerable
Ubuntunumpy22.041:1.19.5-1ubuntu3vulnerable
Ubuntunumpy22.041:1.20.2-1ubuntu1vulnerable
Ubuntunumpy22.041:1.21.4-2vulnerable
Ubuntunumpy22.041:1.21.5-1vulnerable
Ubuntunumpy22.041:1.21.5-1build2vulnerable
Ubuntunumpy22.041:1.21.5-1ubuntu22.04.1fixed
Susepython-numpy_1_13_3-gnu-hpclinux enterprise module for hpc 121.13.3-4.15.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiannumpysourcesid(unfixed)unimportantNot reportedNot reported
Debiannumpysourceforky(unfixed)unimportantNot reportedNot reported
Debiannumpysourcetrixie(unfixed)unimportantNot reportedNot reported
Debiannumpysourcebookworm(unfixed)unimportantNot reportedNot reported
Susepython-numpyrpmlinux enterprise software development kit 12 sp51.8.0-5.14.1Not reportedSUSE-SU-2022:2645-1Not reported
Susepython-numpyrpmlinux enterprise server 12 sp51.8.0-5.14.1Not reportedSUSE-SU-2022:2645-1Not reported
Susepython-numpyrpmlinux enterprise server for sap applications 12 sp51.8.0-5.14.1Not reportedSUSE-SU-2022:2645-1Not reported
Susepython-numpyrpmlinux enterprise module for basesystem 15 sp41.17.3-150400.23.3.1Not reportedSUSE-SU-2022:2646-1Not reported
Susepython-numpy_1_17_3-gnu-hpcrpmlinux enterprise module for hpc 15 sp41.17.3-150400.23.3.1Not reportedSUSE-SU-2022:2646-1Not reported
Opensusepython-numpyrpmleap 15.41.17.3-150400.23.3.1Not reportedSUSE-SU-2022:2646-1Not reported
Opensusepython-numpy_1_17_3-gnu-hpcrpmleap 15.41.17.3-150400.23.3.1Not reportedSUSE-SU-2022:2646-1Not reported
Susepython3-numpyrpmlinux enterprise module for basesystem 15 sp61.17.3-150400.31.1Not reportedSUSE-SU-2025:0424-1Not reported
Susepython-numpy_1_17_3-gnu-hpcrpmlinux enterprise module for hpc 15 sp61.17.3-150400.31.1Not reportedSUSE-SU-2025:0424-1Not reported
Susepython-numpy_1_17_3-gnu-hpcrpmlinux enterprise module for package hub 15 sp61.17.3-150400.31.1Not reportedSUSE-SU-2025:0424-1Not reported
Opensusepython-numpy_1_17_3-gnu-hpcrpmleap 15.61.17.3-150400.31.1Not reportedSUSE-SU-2025:0424-1Not reported
Opensusepython3-numpyrpmleap 15.61.17.3-150400.31.1Not reportedSUSE-SU-2025:0424-1Not reported
Ubuntunumpydeb20.041:1.17.4-5ubuntu3.1Not reportedUBUNTU-CVE-2021-41495Not reported
Ubuntunumpydeb22.041:1.21.5-1ubuntu22.04.1Not reportedUBUNTU-CVE-2021-41495Not reported
Susepython-numpy_1_13_3-gnu-hpcrpmlinux enterprise module for hpc 121.13.3-4.15.1Not reportedSUSE-SU-2022:2793-1Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [python3-numpy]Affected

    Source package: [numpy]

    Details (2)

    • 1:1.24.2-1+deb12u1 · amd64 · bookworm

      Affected

      dsa · numpy · debian · bookworm; dsa · numpy · debian · 12

    • 1:1.24.2-1+deb12u1 · arm64 · bookworm

      Affected

      dsa · numpy · debian · bookworm; dsa · numpy · debian · 12

[Debian 13 (Trixie)]

  • [python3-numpy]Affected

    Source package: [numpy]

    Details (2)

    • 1:2.2.4+ds-1 · amd64 · trixie

      Affected

      dsa · numpy · debian · 13

    • 1:2.2.4+ds-1 · arm64 · trixie

      Affected

      dsa · numpy · debian · 13

  • [python3-numpy-dev]Affected

    Source package: [numpy]

    Details (2)

    • 1:2.2.4+ds-1 · amd64 · trixie

      Affected

      dsa · numpy · debian · 13

    • 1:2.2.4+ds-1 · arm64 · trixie

      Affected

      dsa · numpy · debian · 13

  • [python-numpy-doc]Affected

    Source package: [numpy]

    Details (2)

    • 1:2.2.4+ds-1 · all · trixie

      Affected

      dsa · numpy · debian · 13

    • 1:2.2.4+ds-1 · all · trixie

      Affected

      dsa · numpy · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]