CVE-2026-23528 vulnerabilities

Vulnerabilities for packages: dask-kubernetes, dask-gateway...

fractal-faim-ipa (>=0.6.3, <=0.6.4), jupyter-quant (2510.1.0) +2 more potentially affected by CVE-2026-23528 via distributed (2025.10.0)

distributed PYPI version 2025.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - fractal-faim-ipa =0.6.3, =0.4.5, =0.5.9 Source cves: CVE-2026-23528 Source advisory: OSV:PYSEC-2026-169...

datacube (>=1.8.20, <=1.9.0), datacube-ows (>=1.8.41, <=1.8.43) +8 more potentially affected by CVE-2026-23528 via distributed (2024.10.0)

distributed PYPI version 2024.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - datacube =1.8.20, =1.8.41, =1.1.12, =0.0.0, =0.2.4, =0.1.0, =0.1.9, =1.0.0b0 Source cves: CVE-2026-23528 Source advisory:...

codeentropy (>=1.0.0, <=2.0.0), cugraph-cu12 (25.8.0) +16 more potentially affected by CVE-2026-23528 via distributed (2025.7.0)

distributed PYPI version 2025.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - codeentropy =1.0.0, =0.0.4, =1.0.0, =1.9.5, =0.1.0, =0.5.1 and more Source cves: CVE-2026-23528 Source advisory: OSV:PYSEC-2026-169...

anoexpress (0.3.0), echofish-aws-create-empty-zarr-store-lambda (>=1.0.0.dev20230524182219, <=1.0.0.dev20230705184439) +8 more potentially affected by CVE-2026-23528 via distributed (2024.8.1)

distributed PYPI version 2024.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - anoexpress 0.3.0 - echofish-aws-create-empty-zarr-store-lambda =1.0.0.dev20230524182219, =1.0.0.dev20230906215656,...

egamma-tnp (>=0.3.0, <=0.3.2), labcas-workflow (>=0.1.0, <=0.1.8) +8 more potentially affected by CVE-2026-23528 via distributed (2024.8.2)

distributed PYPI version 2024.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - egamma-tnp =0.3.0, =0.1.0, =1.0.0, =2.0.0b5, =0.1.0, =1.0.0, =0.1.0, =0.1.1, =0.5.0, =0.0.2, =0.0.2.9 Source cves: CVE-2026-23528 Sourc...

cardea (>=0.1.2.dev0, <=0.1.2), evalml (>=0.16.1, <=0.22.0) +13 more potentially affected by CVE-2026-23528 via distributed (2024.2.1)

distributed PYPI version 2024.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - cardea =0.1.2.dev0, =0.16.1, =1.0.0, =0.1.0, =0.12.0, =0.0.2, =0.32.2, =0.3.0.dev0, =2.11.28, =0.3.1, =0.0.1, =0.19.3, =0.19.4 Source...

flowdapt (>=0.1.9, <=0.1.20), hereon-evasuite (>=0.0.1, <=1.0.4) +4 more potentially affected by CVE-2026-23528 via distributed (2024.4.1)

distributed PYPI version 2024.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - flowdapt =0.1.9, =0.0.1, =0.0.0, =0.0.1, =0.0.0, =0.0.3 Source cves: CVE-2026-23528 Source advisory: OSV:PYSEC-2026-169...

autogluon (>=0.0.5, <=0.0.7b17042020) potentially affected by CVE-2026-23528 via distributed (2.6.0)

distributed PYPI version 2.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - autogluon =0.0.5, =0.0.7b17042020 Source cves: CVE-2026-23528 Source advisory: OSV:PYSEC-2026-169...

trenchripper (>=0.0.4, <=0.2.1) potentially affected by CVE-2026-23528 via distributed (2.12.0)

distributed PYPI version 2.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - trenchripper =0.0.4, =0.2.1 Source cves: CVE-2026-23528 Source advisory: OSV:PYSEC-2026-169...

streaming-anomaly-detection (>=0.0.7, <=0.0.9) potentially affected by CVE-2026-23528 via distributed (2.21.0)

distributed PYPI version 2.21.0 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - streaming-anomaly-detection =0.0.7, =0.0.9 Source cves: CVE-2026-23528 Source advisory: OSV:PYSEC-2026-169...

cdp-backend (>=3.0.0.dev4, <=3.0.0.dev5), devito (4.3.0) +4 more potentially affected by CVE-2026-23528 via distributed (2021.1.1)

distributed PYPI version 2021.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - cdp-backend =3.0.0.dev4, =0.1.0, =9.1.2, =0.0.1, =0.0.4 Source cves: CVE-2026-23528 Source advisory: OSV:PYSEC-2026-169...

dask-cuda (>=0.19.0a210422, <=0.19.0), llyr (0.1.0) potentially affected by CVE-2026-23528 via distributed (2021.4.0)

distributed PYPI version 2021.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - dask-cuda =0.19.0a210422, =0.19.0 - llyr 0.1.0 Source cves: CVE-2026-23528 Source advisory: OSV:PYSEC-2026-169...

flowi (>=0.3.8, <=0.3.17), pyoptimus (>=21.9.0b0, <=21.9.0b3) +1 more potentially affected by CVE-2026-23528 via distributed (2021.5.0)

distributed PYPI version 2021.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - flowi =0.3.8, =21.9.0b0, =21.9.0b3 - workoutizer 0.19.0 Source cves: CVE-2026-23528 Source advisory: OSV:PYSEC-2026-169...

elfi (0.3.1) potentially affected by CVE-2026-23528 via distributed (1.14.3)

distributed PYPI version 1.14.3 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - elfi 0.3.1 Source cves: CVE-2026-23528 Source advisory: OSV:PYSEC-2026-169...

pysmfish (>=0.0.0, <=0.0.5), tsfresh (0.11.0) potentially affected by CVE-2026-23528 via distributed (1.18.3)

distributed PYPI version 1.18.3 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - pysmfish =0.0.0, =0.0.5 - tsfresh 0.11.0 Source cves: CVE-2026-23528 Source advisory: OSV:PYSEC-2026-169...

sgm-data (>=0.3.10b0, <=0.3.13b0) potentially affected by CVE-2026-23528 via distributed (2021.8.0)

distributed PYPI version 2021.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - sgm-data =0.3.10b0, =0.3.13b0 Source cves: CVE-2026-23528 Source advisory: OSV:PYSEC-2026-169...

autogluon (>=0.3.2b20211216, <=0.5.3), autogluon-core (>=0.3.2b20211216, <=0.6.3b20230202) +19 more potentially affected by CVE-2026-23528 via distributed (2021.11.2)

distributed PYPI version 2021.11.2 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - autogluon =0.3.2b20211216, =0.3.2b20211216, =0.6.3b20230126, =0.4.3b20220616, =0.3.2b20211216, =0.3.2b20211216, =0.5.0b20220623,...

azureml-automl-dnn-nlp (>=1.37.0, <=1.46.1.post1), azureml-automl-dnn-vision (>=1.37.0, <=1.46.1) +31 more potentially affected by CVE-2026-23528 via distributed (2.30.1)

distributed PYPI version 2.30.1 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - azureml-automl-dnn-nlp =1.37.0, =1.37.0, =1.34.0, =1.37.0, =1.37.0, =0.1.0, =0.9.22.post0, =0.1.0, =0.1.0, =0.1.0a1, =0.0.5, =0.0.5, =0.1...

coiled-runtime (>=0.2.0, <=0.2.1), dask-cuda (>=22.12.0a221208, <=23.2.0a221212) +3 more potentially affected by CVE-2026-23528 via distributed (2022.11.1)

distributed PYPI version 2022.11.1 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - coiled-runtime =0.2.0, =22.12.0a221208, =1.0.0, =0.1.7, =0.4.36 Source cves: CVE-2026-23528 Source advisory: OSV:PYSEC-2026-169...