asc (>=0.1.0, <=0.3.1), openats (>=0.0.0.dev1, <=0.0.0.dev37) potentially affected by CVE-2022-36027 via tensorflow (1.2.1)

tensorflow PYPI version 1.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - asc =0.1.0, =0.0.0.dev1, =0.0.0.dev37 Source cves: CVE-2022-36027 Source advisory: OSV:PYSEC-2026-3128...

es-distributed (0.1.0.dev0), strawberryfields (>=0.7.0, <=0.7.1) +1 more potentially affected by CVE-2022-36027 via tensorflow (1.3.0)

tensorflow PYPI version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - es-distributed 0.1.0.dev0 - strawberryfields =0.7.0, =0.7.1 - utensor-cgen 0.0.4 Source cves: CVE-2022-36027 Source advisory:...

keras-pandas (>=1.1.2, <=2.0.1), learna-tools (0.1.0) potentially affected by CVE-2022-36027 via tensorflow (1.4.0)

tensorflow PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - keras-pandas =1.1.2, =2.0.1 - learna-tools 0.1.0 Source cves: CVE-2022-36027 Source advisory: OSV:PYSEC-2026-3128...

PT-2026-59750

Impact The implementation of FractionalAvgPoolGrad does not fully validate the input orig input tensor shape. This results in an overflow that results in a CHECK failure which can be used to trigger a denial of service attack. python import tensorflow as tf overlapping = True orig input tensor...

PT-2026-59934

Impact When CollectiveGather receives an scalar input input, it gives a CHECK fails that can be used to trigger a denial of service attack. python import tensorflow as tf arg 0=1 arg 1=1 arg 2=1 arg 3=1 arg 4=3, 3,3 arg 5='auto' arg 6=0 arg 7='' tf.raw ops.CollectiveGatherinput=arg 0, group...

PT-2026-59710

Impact When tf.raw ops.ResizeNearestNeighborGrad is given a large size input, it overflows. import tensorflow as tf align corners = True half pixel centers = False grads = tf.constant1, shape=1,8,16,3, dtype=tf.float16 size = tf.constant1879048192,1879048192, shape=2, dtype=tf.int32 tf.raw...

PT-2026-59782

Impact If FractionMaxPoolGrad is given outsize inputs row pooling sequence and col pooling sequence, TensorFlow will crash. python import tensorflow as tf tf.raw ops.FractionMaxPoolGrad orig input = 1, 1, 1, 1, 1, orig output = 1, 1, 1, out backprop = 3, 3, 6, row pooling sequence = -0x4000000, 1...

PT-2026-59902

Impact When running with XLA, tf.raw ops.ParallelConcat segfaults with a nullptr dereference when given a parameter shape with rank that is not greater than zero. python import tensorflow as tf func = tf.raw ops.ParallelConcat para = 'shape': 0, 'values': 1 @tf.functionjit compile=True def test: ...

PT-2026-59759

Impact If the parameter indices for DynamicStitch does not match the shape of the parameter data, it can trigger an stack OOB read. python import tensorflow as tf func = tf.raw ops.DynamicStitch para='indices': 0xdeadbeef, 405, 519, 758, 1015, 'data': 110.27793884277344, 120.29475402832031,...

PT-2026-59993

Impact If Requantize is given input min, input max, requested output min, requested output max tensors of a nonzero rank, it results in a segfault that can be used to trigger a denial of service attack. python import tensorflow as tf out type = tf.quint8 input = tf.constant1, shape=3,...

PT-2026-59995

Impact The RaggedRangOp function takes an argument limits that is eventually used to construct a TensorShape as an int64. If limits is a very large float, it can overflow when converted to an int64. This triggers an InvalidArgument but also throws an abort signal that crashes the program. python...

PT-2026-59825

Impact If a numpy array is created with a shape such that one element is zero and the others sum to a large number, an error will be raised. E.g. the following raises an error: python np.ones0, 231, 231 An example of a proof of concept: python import numpy as np import tensorflow as tf input val ...

PT-2026-59737

Impact If QuantizedMatMul is given nonscalar input for: - min a - max a - min b - max b It gives a segfault that can be used to trigger a denial of service attack. python import tensorflow as tf Toutput = tf.qint32 transpose a = False transpose b = False Tactivation = tf.quint8 a = tf.constant7,...

PT-2026-59988

Impact When TensorListScatter and TensorListScatterV2 receive an element shape of a rank greater than one, they give a CHECK fail that can trigger a denial of service attack. python import tensorflow as tf arg 0=tf.random.uniformshape=2, 2, 2, dtype=tf.float16, maxval=None arg...

PT-2026-59944

Impact NPE in RandomShuffle with XLA enable python import tensorflow as tf func = tf.raw ops.RandomShuffle para = 'value': 1e+20, 'seed': -4294967297, 'seed2': -2147483649 @tf.functionjit compile=True def test: y = funcpara return y test Patches We have patched the issue in GitHub commit...

PT-2026-59876

Impact An input pooling ratio that is smaller than 1 will trigger a heap OOB in tf.raw ops.FractionalMaxPool and tf.raw ops.FractionalAvgPool. Patches We have patched the issue in GitHub commit 216525144ee7c910296f5b05d214ca1327c9ce48. The fix will be included in TensorFlow 2.11.0. We will also...

PT-2026-59997

Impact An input pooling ratio that is smaller than 1 will trigger a heap OOB in tf.raw ops.FractionalMaxPool and tf.raw ops.FractionalAvgPool. Patches We have patched the issue in GitHub commit 216525144ee7c910296f5b05d214ca1327c9ce48. The fix will be included in TensorFlow 2.11.0. We will also...

PT-2026-59735

Impact If tf.raw ops.TensorListConcat is given element shape=, it results segmentation fault which can be used to trigger a denial of service attack. python import tensorflow as tf tf.raw ops.TensorListConcat input handle=tf.data.experimental.to varianttf.data.Dataset.from tensor slices1, 2, 3,...

PT-2026-59898

Impact If tf.raw ops.TensorListConcat is given element shape=, it results segmentation fault which can be used to trigger a denial of service attack. python import tensorflow as tf tf.raw ops.TensorListConcat input handle=tf.data.experimental.to varianttf.data.Dataset.from tensor slices1, 2, 3,...

PT-2026-59905

Impact When converting transposed convolutions using per-channel weight quantization the converter segfaults and crashes the Python process. python import tensorflow as tf class QuantConv2DTransposedtf.keras.layers.Layer: def buildself, input shape: self.kernel = self.add weight"kernel", 3, 3,...