Tensorflow (Google) - vulnerabilities (CVEs)

431 CVEs, 0 in the last 30 days, 452 known versions, newest CVE from 2025-09-25. Vendor: Google.

CVEs of Tensorflow

CVE-2025-55559 - CVSS 7.5 (high), 2025-09-25: An issue was discovered TensorFlow v2.18.0. A Denial of Service (DoS) occurs when padding is set to 'valid' in tf.keras.layers.Conv2D.
CVE-2025-55556 - CVSS 6.5 (medium), 2025-09-25: TensorFlow v2.18.0 was discovered to output random results when compiling Embedding, leading to unexpected behavior in the application.
CVE-2025-0649 - CVSS 8.9 (high), 2025-05-06: Incorrect JSON input stringification in Google's Tensorflow serving versions up to 2.18.0 allows for potentially unbounded recursion leading to server crash.
CVE-2023-33976 - CVSS 7.5 (high), 2024-07-30: TensorFlow is an end-to-end open source platform for machine learning. `array_ops.upper_bound` causes a segfault when not given a rank 2 tensor. The fix will…
CVE-2023-25661 - CVSS 6.5 (medium), 2023-03-27: TensorFlow is an Open Source Machine Learning Framework. In versions prior to 2.11.1 a malicious invalid input crashes a tensorflow model (Check Failed) and…
CVE-2023-27579 - CVSS 7.5 (high), 2023-03-25: TensorFlow is an end-to-end open source platform for machine learning. Constructing a tflite model with a paramater `filter_input_channel` of less than 1…
CVE-2023-25801 - CVSS 8 (high), 2023-03-25: TensorFlow is an open source machine learning platform. Prior to versions 2.12.0 and 2.11.1, `nn_ops.fractional_avg_pool_v2` and…
CVE-2023-25676 - CVSS 7.5 (high), 2023-03-25: TensorFlow is an open source machine learning platform. When running versions prior to 2.12.0 and 2.11.1 with XLA, `tf.raw_ops.ParallelConcat` segfaults with…
CVE-2023-25669 - CVSS 7.5 (high), 2023-03-25: TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, if the stride and window size are not positive for…
CVE-2023-25672 - CVSS 7.5 (high), 2023-03-25: TensorFlow is an open source platform for machine learning. The function `tf.raw_ops.LookupTableImportV2` cannot handle scalars in the `values` parameter and…
CVE-2023-25658 - CVSS 7.5 (high), 2023-03-25: TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, an out of bounds read is in GRUBlockCellGrad. A fix is…
CVE-2023-25675 - CVSS 7.5 (high), 2023-03-25: TensorFlow is an open source machine learning platform. When running versions prior to 2.12.0 and 2.11.1 with XLA, `tf.raw_ops.Bincount` segfaults when given…
CVE-2023-25662 - CVSS 7.5 (high), 2023-03-25: TensorFlow is an open source platform for machine learning. Versions prior to 2.12.0 and 2.11.1 are vulnerable to integer overflow in EditDistance. A fix is…
CVE-2023-25665 - CVSS 7.5 (high), 2023-03-25: TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, when `SparseSparseMaximum` is given invalid sparse tensors as…
CVE-2023-25668 - CVSS 9.8 (critical), 2023-03-25: TensorFlow is an open source platform for machine learning. Attackers using Tensorflow prior to 2.12.0 or 2.11.1 can access heap memory which is not in the…
CVE-2023-25671 - CVSS 7.5 (high), 2023-03-25: TensorFlow is an open source platform for machine learning. There is out-of-bounds access due to mismatched integer type sizes. A fix is included in…
CVE-2023-25674 - CVSS 7.5 (high), 2023-03-25: TensorFlow is an open source machine learning platform. Versions prior to 2.12.0 and 2.11.1 have a null pointer error in RandomShuffle with XLA enabled. A fix…
CVE-2023-25660 - CVSS 7.5 (high), 2023-03-25: TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, when the parameter `summarize` of `tf.raw_ops.Print` is zero,…
CVE-2023-25664 - CVSS 9.8 (critical), 2023-03-25: TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, there is a heap buffer overflow in TAvgPoolGrad. A fix is…
CVE-2023-25667 - CVSS 7.5 (high), 2023-03-25: TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, integer overflow occurs when `2^31 <= num_frames * height *…
CVE-2023-25670 - CVSS 7.5 (high), 2023-03-25: TensorFlow is an open source platform for machine learning. Versions prior to 2.12.0 and 2.11.1 have a null point error in…
CVE-2023-25673 - CVSS 7.5 (high), 2023-03-25: TensorFlow is an open source platform for machine learning. Versions prior to 2.12.0 and 2.11.1 have a Floating Point Exception in TensorListSplit with XLA. A…
CVE-2023-25659 - CVSS 7.5 (high), 2023-03-25: TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, if the parameter `indices` for `DynamicStitch` does not match…
CVE-2023-25663 - CVSS 7.5 (high), 2023-03-25: TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, when `ctx->step_containter()` is a null ptr, the Lookup…
CVE-2023-25666 - CVSS 7.5 (high), 2023-03-25: TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, there is a floating point exception in AudioSpectrogram. A…
CVE-2022-41910 - CVSS 9.1 (critical), 2022-12-06: TensorFlow is an open source platform for machine learning. The function MakeGrapplerFunctionItem takes arguments that determine the sizes of inputs and…
CVE-2022-41902 - CVSS 9.1 (critical), 2022-12-06: TensorFlow is an open source platform for machine learning. The function MakeGrapplerFunctionItem takes arguments that determine the sizes of inputs and…
CVE-2022-41911 - CVSS 7.5 (high), 2022-11-18: TensorFlow is an open source platform for machine learning. When printing a tensor, we get it's data as a `const char*` array (since that's the underlying…
CVE-2022-41909 - CVSS 7.5 (high), 2022-11-18: TensorFlow is an open source platform for machine learning. An input `encoded` that is not a valid `CompositeTensorVariant` tensor will trigger a segfault in…
CVE-2022-41907 - CVSS 7.5 (high), 2022-11-18: TensorFlow is an open source platform for machine learning. When `tf.raw_ops.ResizeNearestNeighborGrad` is given a large `size` input, it overflows. We have…
CVE-2022-41908 - CVSS 7.5 (high), 2022-11-18: TensorFlow is an open source platform for machine learning. An input `token` that is not a UTF-8 bytestring will trigger a `CHECK` fail in…
CVE-2022-41901 - CVSS 7.5 (high), 2022-11-18: TensorFlow is an open source platform for machine learning. An input `sparse_matrix` that is not a matrix with a shape with rank 0 will trigger a `CHECK` fail…
CVE-2022-41900 - CVSS 9.8 (critical), 2022-11-18: TensorFlow is an open source platform for machine learning. The security vulnerability results in FractionalMax(AVG)Pool with illegal pooling_ratio. Attackers…
CVE-2022-41898 - CVSS 7.5 (high), 2022-11-18: TensorFlow is an open source platform for machine learning. If `SparseFillEmptyRowsGrad` is given empty inputs, TensorFlow will crash. We have patched the…
CVE-2022-41897 - CVSS 7.5 (high), 2022-11-18: TensorFlow is an open source platform for machine learning. If `FractionMaxPoolGrad` is given outsize inputs `row_pooling_sequence` and…
CVE-2022-41899 - CVSS 7.5 (high), 2022-11-18: TensorFlow is an open source platform for machine learning. Inputs `dense_features` or `example_state_data` not of rank 2 will trigger a `CHECK` fail in…
CVE-2022-41895 - CVSS 7.5 (high), 2022-11-18: TensorFlow is an open source platform for machine learning. If `MirrorPadGrad` is given outsize input `paddings`, TensorFlow will give a heap OOB error. We…
CVE-2022-41896 - CVSS 7.5 (high), 2022-11-18: TensorFlow is an open source platform for machine learning. If `ThreadUnsafeUnigramCandidateSampler` is given input `filterbank_channel_count` greater than…
CVE-2022-41894 - CVSS 8.1 (high), 2022-11-18: TensorFlow is an open source platform for machine learning. The reference kernel of the `CONV_3D_TRANSPOSE` TensorFlow Lite operator wrongly increments the…
CVE-2022-41893 - CVSS 7.5 (high), 2022-11-18: TensorFlow is an open source platform for machine learning. If `tf.raw_ops.TensorListResize` is given a nonscalar value for input `size`, it results `CHECK`…
CVE-2022-41891 - CVSS 7.5 (high), 2022-11-18: TensorFlow is an open source platform for machine learning. If `tf.raw_ops.TensorListConcat` is given `element_shape=[]`, it results segmentation fault which…
CVE-2022-41890 - CVSS 7.5 (high), 2022-11-18: TensorFlow is an open source platform for machine learning. If `BCast::ToShape` is given input larger than an `int32`, it will crash, despite being supposed…
CVE-2022-41888 - CVSS 7.5 (high), 2022-11-18: TensorFlow is an open source platform for machine learning. When running on GPU, `tf.image.generate_bounding_box_proposals` receives a `scores` input that…
CVE-2022-41889 - CVSS 7.5 (high), 2022-11-18: TensorFlow is an open source platform for machine learning. If a list of quantized tensors is assigned to an attribute, the pywrap code fails to parse the…
CVE-2022-41885 - CVSS 7.5 (high), 2022-11-18: TensorFlow is an open source platform for machine learning. When `tf.raw_ops.FusedResizeAndPadConv2D` is given a large tensor shape, it overflows. We have…
CVE-2022-41887 - CVSS 7.5 (high), 2022-11-18: TensorFlow is an open source platform for machine learning. `tf.keras.losses.poisson` receives a `y_pred` and `y_true` that are passed through `functor::mul`…
CVE-2022-41886 - CVSS 7.5 (high), 2022-11-18: TensorFlow is an open source platform for machine learning. When `tf.raw_ops.ImageProjectiveTransformV2` is given a large output shape, it overflows. We have…
CVE-2022-41884 - CVSS 7.5 (high), 2022-11-18: TensorFlow is an open source platform for machine learning. If a numpy array is created with a shape such that one element is zero and the others sum to a…
CVE-2022-41880 - CVSS 9.1 (critical), 2022-11-18: TensorFlow is an open source platform for machine learning. When the `BaseCandidateSamplerOp` function receives a value in `true_classes` larger than…
CVE-2022-41883 - CVSS 7.5 (high), 2022-11-18: TensorFlow is an open source platform for machine learning. When ops that have specified input sizes receive a differing number of inputs, the executor will…
CVE-2022-36012 - CVSS 7.5 (high), 2022-09-16: TensorFlow is an open source platform for machine learning. When `mlir::tfg::ConvertGenericFunctionToFunctionDef` is given empty function attributes, it…
CVE-2022-36015 - CVSS 7.5 (high), 2022-09-16: TensorFlow is an open source platform for machine learning. When `RangeSize` receives values that do not fit into an `int64_t`, it crashes. We have patched…
CVE-2022-36027 - CVSS 7.5 (high), 2022-09-16: TensorFlow is an open source platform for machine learning. When converting transposed convolutions using per-channel weight quantization the converter…
CVE-2022-36011 - CVSS 7.5 (high), 2022-09-16: TensorFlow is an open source platform for machine learning. When `mlir::tfg::ConvertGenericFunctionToFunctionDef` is given empty function attributes, it gives…
CVE-2022-36014 - CVSS 7.5 (high), 2022-09-16: TensorFlow is an open source platform for machine learning. When `mlir::tfg::TFOp::nameAttr` receives null type list attributes, it crashes. We have patched…
CVE-2022-36017 - CVSS 7.5 (high), 2022-09-16: TensorFlow is an open source platform for machine learning. If `Requantize` is given `input_min`, `input_max`, `requested_output_min`, `requested_output_max`…
CVE-2022-36013 - CVSS 7.5 (high), 2022-09-16: TensorFlow is an open source platform for machine learning. When `mlir::tfg::GraphDefImporter::ConvertNodeDef` tries to convert NodeDefs without an op name,…
CVE-2022-36016 - CVSS 7.5 (high), 2022-09-16: TensorFlow is an open source platform for machine learning. When `tensorflow::full_type::SubstituteFromAttrs` receives a `FullTypeDef& t` that is not exactly…
CVE-2022-36001 - CVSS 7.5 (high), 2022-09-16: TensorFlow is an open source platform for machine learning. When `DrawBoundingBoxes` receives an input `boxes` that is not of dtype `float`, it gives a…
CVE-2022-36004 - CVSS 7.5 (high), 2022-09-16: TensorFlow is an open source platform for machine learning. When `tf.random.gamma` receives large input shape and rates, it gives a `CHECK` fail that can…
CVE-2022-35991 - CVSS 7.5 (high), 2022-09-16: TensorFlow is an open source platform for machine learning. When `TensorListScatter` and `TensorListScatterV2` receive an `element_shape` of a rank greater…
CVE-2022-35994 - CVSS 7.5 (high), 2022-09-16: TensorFlow is an open source platform for machine learning. When `CollectiveGather` receives an scalar input `input`, it gives a `CHECK` fails that can be…
CVE-2022-35997 - CVSS 7.5 (high), 2022-09-16: TensorFlow is an open source platform for machine learning. If `tf.sparse.cross` receives an input `separator` that is not a scalar, it gives a `CHECK` fail…
CVE-2022-36000 - CVSS 7.5 (high), 2022-09-16: TensorFlow is an open source platform for machine learning. When `mlir::tfg::ConvertGenericFunctionToFunctionDef` is given empty function attributes, it gives…
CVE-2022-36003 - CVSS 7.5 (high), 2022-09-16: TensorFlow is an open source platform for machine learning. When `RandomPoissonV2` receives large input shape and rates, it gives a `CHECK` fail that can…
CVE-2022-35993 - CVSS 7.5 (high), 2022-09-16: TensorFlow is an open source platform for machine learning. When `SetSize` receives an input `set_shape` that is not a 1D tensor, it gives a `CHECK` fails…
CVE-2022-35996 - CVSS 7.5 (high), 2022-09-16: TensorFlow is an open source platform for machine learning. If `Conv2D` is given empty `input` and the `filter` and `padding` sizes are valid, the output is…
CVE-2022-35999 - CVSS 7.5 (high), 2022-09-16: TensorFlow is an open source platform for machine learning. When `Conv2DBackpropInput` receives empty `out_backprop` inputs (e.g. `[3, 1, 0, 1]`), the current…
CVE-2022-36002 - CVSS 7.5 (high), 2022-09-16: TensorFlow is an open source platform for machine learning. When `Unbatch` receives a nonscalar input `id`, it gives a `CHECK` fail that can trigger a denial…
CVE-2022-36005 - CVSS 7.5 (high), 2022-09-16: TensorFlow is an open source platform for machine learning. When `tf.quantization.fake_quant_with_min_max_vars_gradient` receives input `min` or `max` that is…
CVE-2022-35992 - CVSS 7.5 (high), 2022-09-16: TensorFlow is an open source platform for machine learning. When `TensorListFromTensor` receives an `element_shape` of a rank greater than one, it gives a…
CVE-2022-35995 - CVSS 7.5 (high), 2022-09-16: TensorFlow is an open source platform for machine learning. When `AudioSummaryV2` receives an input `sample_rate` with more than one element, it gives a…
CVE-2022-35998 - CVSS 7.5 (high), 2022-09-16: TensorFlow is an open source platform for machine learning. If `EmptyTensorList` receives an input `element_shape` with more than one dimension, it gives a…
CVE-2022-35988 - CVSS 7.5 (high), 2022-09-16: TensorFlow is an open source platform for machine learning. When `tf.linalg.matrix_rank` receives an empty input `a`, the GPU kernel gives a `CHECK` fail that…
CVE-2022-36018 - CVSS 7.5 (high), 2022-09-16: TensorFlow is an open source platform for machine learning. If `RaggedTensorToVariant` is given a `rt_nested_splits` list that contains tensors of ranks other…
CVE-2022-35981 - CVSS 7.5 (high), 2022-09-16: TensorFlow is an open source platform for machine learning. `FractionalMaxPoolGrad` validates its inputs with `CHECK` failures instead of with returning…
CVE-2022-35984 - CVSS 7.5 (high), 2022-09-16: TensorFlow is an open source platform for machine learning. `ParameterizedTruncatedNormal` assumes `shape` is of type `int32`. A valid `shape` of type `int64`…
CVE-2022-35987 - CVSS 7.5 (high), 2022-09-16: TensorFlow is an open source platform for machine learning. `DenseBincount` assumes its input tensor `weights` to either have the same shape as its input…
CVE-2022-35990 - CVSS 7.5 (high), 2022-09-16: TensorFlow is an open source platform for machine learning. When `tf.quantization.fake_quant_with_min_max_vars_per_channel_gradient` receives input `min` or…
CVE-2022-36026 - CVSS 7.5 (high), 2022-09-16: TensorFlow is an open source platform for machine learning. If `QuantizeAndDequantizeV3` is given a nonscalar `num_bits` input tensor, it results in a `CHECK`…
CVE-2022-35979 - CVSS 7.5 (high), 2022-09-16: TensorFlow is an open source platform for machine learning. If `QuantizedRelu` or `QuantizedRelu6` are given nonscalar inputs for `min_features` or…
CVE-2022-35983 - CVSS 7.5 (high), 2022-09-16: TensorFlow is an open source platform for machine learning. If `Save` or `SaveSlices` is run over tensors of an unsupported `dtype`, it results in a `CHECK`…
CVE-2022-35986 - CVSS 7.5 (high), 2022-09-16: TensorFlow is an open source platform for machine learning. If `RaggedBincount` is given an empty input tensor `splits`, it results in a segfault that can be…
CVE-2022-35989 - CVSS 7.5 (high), 2022-09-16: TensorFlow is an open source platform for machine learning. When `MaxPool` receives a window size input array `ksize` with dimensions greater than its input…
CVE-2022-36019 - CVSS 7.5 (high), 2022-09-16: TensorFlow is an open source platform for machine learning. If `FakeQuantWithMinMaxVarsPerChannel` is given `min` or `max` tensors of a rank other than one,…
CVE-2022-35982 - CVSS 7.5 (high), 2022-09-16: TensorFlow is an open source platform for machine learning. If `SparseBincount` is given inputs for `indices`, `values`, and `dense_shape` that do not make a…
CVE-2022-35985 - CVSS 7.5 (high), 2022-09-16: TensorFlow is an open source platform for machine learning. If `LRNGrad` is given an `output_image` input tensor that is not 4-D, it results in a `CHECK` fail…
CVE-2022-35967 - CVSS 7.5 (high), 2022-09-16: TensorFlow is an open source platform for machine learning. If `QuantizedAdd` is given `min_input` or `max_input` tensors of a nonzero rank, it results in a…
CVE-2022-35970 - CVSS 7.5 (high), 2022-09-16: TensorFlow is an open source platform for machine learning. If `QuantizedInstanceNorm` is given `x_min` or `x_max` tensors of a nonzero rank, it results in a…
CVE-2022-35973 - CVSS 7.5 (high), 2022-09-16: TensorFlow is an open source platform for machine learning. If `QuantizedMatMul` is given nonscalar input for: `min_a`, `max_a`, `min_b`, or `max_b` It gives…
CVE-2022-35966 - CVSS 7.5 (high), 2022-09-16: TensorFlow is an open source platform for machine learning. If `QuantizedAvgPool` is given `min_input` or `max_input` tensors of a nonzero rank, it results in…
CVE-2022-35969 - CVSS 7.5 (high), 2022-09-16: TensorFlow is an open source platform for machine learning. The implementation of `Conv2DBackpropInput` requires `input_sizes` to be 4-dimensional. Otherwise,…
CVE-2022-35972 - CVSS 7.5 (high), 2022-09-16: TensorFlow is an open source platform for machine learning. If `QuantizedBiasAdd` is given `min_input`, `max_input`, `min_bias`, `max_bias` tensors of a…
CVE-2022-35968 - CVSS 7.5 (high), 2022-09-16: TensorFlow is an open source platform for machine learning. The implementation of `AvgPoolGrad` does not fully validate the input `orig_input_shape`. This…
CVE-2022-35971 - CVSS 7.5 (high), 2022-09-16: TensorFlow is an open source platform for machine learning. If `FakeQuantWithMinMaxVars` is given `min` or `max` tensors of a nonzero rank, it results in a…
CVE-2022-35974 - CVSS 7.5 (high), 2022-09-16: TensorFlow is an open source platform for machine learning. If `QuantizeDownAndShrinkRange` is given nonscalar inputs for `input_min` or `input_max`, it…
CVE-2022-35965 - CVSS 7.5 (high), 2022-09-16: TensorFlow is an open source platform for machine learning. If `LowerBound` or `UpperBound` is given an empty`sorted_inputs` input, it results in a `nullptr`…
CVE-2022-35964 - CVSS 7.5 (high), 2022-09-16: TensorFlow is an open source platform for machine learning. The implementation of `BlockLSTMGradV2` does not fully validate its inputs. This results in a a…
CVE-2022-35935 - CVSS 7.5 (high), 2022-09-16: TensorFlow is an open source platform for machine learning. The implementation of SobolSampleOp is vulnerable to a denial of service via CHECK-failure…
CVE-2022-35939 - CVSS 9.8 (critical), 2022-09-16: TensorFlow is an open source platform for machine learning. The `ScatterNd` function takes an input argument that determines the indices of of the output…