CVE-2016-1517: OpenCV-Python Denial of Service Vulnerability Due to Improper Input Validation
Summary
CVE-2016-1517: Improper Input Validation in OpenCV. Affects opencv-python versions < 3.3.1.11. Fixed in 3.3.1.11. How to fix ↓
Also tracked for
- opencv-contrib-python · PyPI
- opencv · Debian:11
The same CVE-2016-1517 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenCV is an open-source computer vision and machine learning software library that provides a common infrastructure for computer vision applications. It is widely used in real-time image processing and computer vision tasks. The library supports various programming languages, including Python, and is known for its extensive functionality and performance. However, OpenCV has been found to have a vulnerability that can lead to denial of service, particularly in the opencv-python package, which is a Python wrapper for the OpenCV library.
Vulnerability Detail
The vulnerability identified as CVE-2016-1517 in OpenCV version 3.0.0 allows remote attackers to exploit improper input validation, leading to a segmentation fault (segfault). This can occur through the processing of corrupt chunks, which can crash the application and disrupt service. The issue was addressed in version 3.3.1.11, highlighting the importance of keeping the library updated to mitigate such risks.
How To Fix
Latest published version: 5.0.0.93 as of 23 Oct 2026
pip install --upgrade "opencv-python==5.0.0.93"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.3.1.11
This is the first release that contains the fix.
pip install --upgrade "opencv-python==3.3.1.11"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot immediately update the package, consider implementing input validation checks in your application to prevent processing of potentially corrupt data. This may involve sanitizing inputs or adding error handling to gracefully manage unexpected data.
Conclusion
The CVE-2016-1517 vulnerability in OpenCV poses a risk of denial of service due to improper input validation. It is crucial for developers using the opencv-python package to update to the patched version to mitigate this risk. Additionally, implementing input validation can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for opencv-python →
FAQ
CVE-2016-1517 is a vulnerability in OpenCV that allows remote attackers to cause a denial of service due to improper input validation.
If your application uses OpenCV version 3.0.0, it may crash when processing corrupt data, leading to service disruption.
The vulnerability affects OpenCV version 3.0.0 and was fixed in version 3.3.1.11.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
The CVSS score for this vulnerability is 5.5, indicating a moderate level of risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for opencv-python.
