AIKIDO-2025-10405
cvxpy.cvxpy is vulnerable to Integer Overflow
25
Low Risk
This Affects:
cvxpy.cvxpyTL;DR
NumPy’s default integer type on Windows is int32, which can cause integer overflows in operations like np.prod((60000, 60000)), returning incorrect negative values. In flatten_tensor, Python integers are generally cast to int64, but one instance applies this conversion too late, after the overflow has already occurred. Explicitly setting dtype=np.int64 in np.prod prevents this issue by ensuring calculations use 64-bit integers.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you are using Windows.
Background info
cvxpy.cvxpy is vulnerable to Integer Overflow in versions 1.3.4 - 1.5.1.
How to fix this
Upgrade the cvxpy.cvxpy library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.