cvxpy.cvxpy is vulnerable to Integer Overflow
25
Low Risk
NumPy’s default integer type on Windows is int32, which can cause integer overflows in operations like np.prod((60000, 60000)), returning incorrect negative values. In flatten_tensor, Python integers are generally cast to int64, but one instance applies this conversion too late, after the overflow has already occurred. Explicitly setting dtype=np.int64 in np.prod prevents this issue by ensuring calculations use 64-bit integers.
You are affected if you are using a version that falls within the vulnerable range and you are using Windows.
cvxpy.cvxpy is vulnerable to Integer Overflow in versions 1.3.4 - 1.5.1.
Upgrade the cvxpy.cvxpy library to the patch version.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

SOC 2Compliant
ISO 27001Compliant