CVE-2020-28975

svm_predict_values in svm.cpp in Libsvm v324, as used in scikit-learn 0.23.2 and other products, allows attackers to cause a denial of service (segmentation fault) via a crafted model SVM (introduced via pickle, json, or any other model permanence standard) with a large value in the _n_support array. NOTE: the scikit-learn vendor's position is that the behavior can only occur if the library's API is violated by an application that changes a private attribute.

• http://packetstormsecurity.com/files/160281/SciKit-Learn-0.23.2-Denial-Of-Service.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2020/Nov/44Mailing List, Third Party Advisory
• https://github.com/cjlin1/libsvm/blob/9a3a9708926dec87d382c43b203f2ca19c2d56a0/svm.cpp#L2501Exploit, Third Party Advisory
• https://github.com/scikit-learn/scikit-learn/commit/1bf13d567d3cd74854aa8343fd25b61dd768bb85Patch, Third Party Advisory
• https://github.com/scikit-learn/scikit-learn/issues/18891Exploit, Issue Tracking, Third Party Advisory
• https://security.gentoo.org/glsa/202301-03Third Party Advisory
• http://packetstormsecurity.com/files/160281/SciKit-Learn-0.23.2-Denial-Of-Service.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2020/Nov/44Mailing List, Third Party Advisory
• https://github.com/cjlin1/libsvm/blob/9a3a9708926dec87d382c43b203f2ca19c2d56a0/svm.cpp#L2501Exploit, Third Party Advisory
• https://github.com/scikit-learn/scikit-learn/commit/1bf13d567d3cd74854aa8343fd25b61dd768bb85Patch, Third Party Advisory
• https://github.com/scikit-learn/scikit-learn/issues/18891Exploit, Issue Tracking, Third Party Advisory
• https://security.gentoo.org/glsa/202301-03Third Party Advisory

Published

Nov 21, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-2897Vulnerability in the MySQL Server product of Oracle MySQL (c…4.9
• CVE-2020-28970An issue was discovered on Western Digital My Cloud OS 5 dev…9.8
• CVE-2020-28971An issue was discovered on Western Digital My Cloud OS 5 dev…9.8
• CVE-2020-28972In SaltStack Salt before 3002.5, authentication to VMware vc…5.9
• CVE-2020-28973The ABUS Secvest wireless alarm system FUAA50000 (v3.01.17) …7.5
• CVE-2020-28974A slab-out-of-bounds read in fbcon in the Linux kernel befor…5
• CVE-2020-28976The Canto plugin 1.3.0 for WordPress contains a blind SSRF v…5.3
• CVE-2020-28977The Canto plugin 1.3.0 for WordPress contains blind SSRF vul…5.3
• CVE-2020-28978The Canto plugin 1.3.0 for WordPress contains blind SSRF vul…5.3
• CVE-2020-2898Vulnerability in the MySQL Server product of Oracle MySQL (c…4.9
• CVE-2020-28984prive/formulaires/configurer_preferences.php in SPIP before …9.8
• CVE-2020-2899Vulnerability in the PeopleSoft Enterprise SCM Purchasing pr…4.8