PYSEC-2026-3359 TensorFlow vulnerable to OOB read in `Gather_nd` in TF Lite

Impact The GatherNd function takes arguments that determine the sizes of inputs and outputs. If the inputs given are greater than or equal to the sizes of the outputs, an out-of-bounds memory read is triggered. Patches We have patched the issue in GitHub commit...

mlbench-core (>=2.4.0.dev276, <=2.4.0.dev279), openml-keras (0.0.0) +8 more potentially affected by CVE-2022-35939 via tensorflow (1.13.2)

tensorflow PYPI version 1.13.2 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - mlbench-core =2.4.0.dev276, =0.1.0, =0.4.0, =0.14.0, =0.1.4, =0.3.0, =0.3.4 - rasa-print 0.3.1 Source cves: CVE-2022-35939 Source advisory:...

abba-python (>=0.1.6, <=0.3.0), adversal-embedding (>=0.0.1, <=0.0.7) +52 more potentially affected by CVE-2022-35939 via tensorflow (1.15.0)

tensorflow PYPI version 1.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - abba-python =0.1.6, =0.0.1, =0.2.6, =2023.1.0, =0.2.11, =0.0.4, =0.10.0, =0.10.1 - deepaclive 0.1.0 and more Source cves: CVE-2022-35939...

axelerate (>=0.5.8, <=0.5.9), bianbu-ai-toolkit-tf1 (1.0.6) +27 more potentially affected by CVE-2022-35939 via tensorflow (1.15.3)

tensorflow PYPI version 1.15.3 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - axelerate =0.5.8, =0.0.1.2, =0.0.13, =1.1.0, =0.22.0, =1.6.0, =4.1.3, =0.10.0.dev1, =0.11.0 - muffnn 2.3.1 - neoepiscope 0.4.0 and more...

cf-nlp (>=0.1.0, <=0.1.1), dlgo (0.2.0) +2 more potentially affected by CVE-2022-35939 via tensorflow (1.10.1)

tensorflow PYPI version 1.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - cf-nlp =0.1.0, =0.6.0, =0.6.1 Source cves: CVE-2022-35939 Source advisory: OSV:PYSEC-2026-3171...

axelerate (>=0.5.2, <=0.5.5), bert-experimental (1.0.0) +24 more potentially affected by CVE-2022-35939 via tensorflow (1.15.2)

tensorflow PYPI version 1.15.2 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - axelerate =0.5.2, =2.0.1, =1.0.1, =0.1.0.dev1, =1.5.0.dev20210429, =1.5.0.dev20210512 - fedlearner-manylinux 1.5.0.dev20210429 -...

alfabet (0.0.5), alibi (>=0.3.1, <=0.5.1) +67 more potentially affected by CVE-2022-35939 via tensorflow (1.15.5)

tensorflow PYPI version 1.15.5 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - alfabet 0.0.5 - alibi =0.3.1, =0.1.0, =1.0.2, =0.1.0a3, =0.1.1, =0.0.1, =0.1.14, =0.2.0, =0.0.1, =0.1.0, =0.7.0 and more Source cves:...

program-synthesis (0.1.2), qfragment (0.0.16) potentially affected by CVE-2022-35939 via tensorflow (1.5.1)

tensorflow PYPI version 1.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - program-synthesis 0.1.2 - qfragment 0.0.16 Source cves: CVE-2022-35939 Source advisory: OSV:PYSEC-2026-3171...

animalai-train (0.4.0), mlagents (>=0.4.0, <=0.10.0.dev0) +2 more potentially affected by CVE-2022-35939 via tensorflow (1.7.1)

tensorflow PYPI version 1.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - animalai-train 0.4.0 - mlagents =0.4.0, =0.10.0.dev0 - pytransdec 0.2.1 - unityagents 0.4.0 Source cves: CVE-2022-35939 Source advisory:...

fancy-nlp (>=0.0.1, <=0.0.4), nyoka (>=1.0.0, <=1.5.4) +3 more potentially affected by CVE-2022-35997 via tensorflow (1.9.0)

tensorflow PYPI version 1.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - fancy-nlp =0.0.1, =1.0.0, =0.11.0, =0.5.4, =0.5.7 Source cves: CVE-2022-35997 Source advisory: OSV:PYSEC-2026-3220...

asc (>=0.1.0, <=0.3.1), openats (>=0.0.0.dev1, <=0.0.0.dev37) potentially affected by CVE-2022-35997 via tensorflow (1.2.1)

tensorflow PYPI version 1.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - asc =0.1.0, =0.0.0.dev1, =0.0.0.dev37 Source cves: CVE-2022-35997 Source advisory: OSV:PYSEC-2026-3220...

cf-nlp (>=0.1.0, <=0.1.1), dlgo (0.2.0) +2 more potentially affected by CVE-2022-35997 via tensorflow (1.10.1)

tensorflow PYPI version 1.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - cf-nlp =0.1.0, =0.6.0, =0.6.1 Source cves: CVE-2022-35997 Source advisory: OSV:PYSEC-2026-3220...

aadhaar-detection (0.5.0), abmarl (>=0.1.1, <=0.1.3) +551 more potentially affected by CVE-2022-35997 via tensorflow (>=2.0.0, <=2.7.1)

tensorflow PYPI version =2.0.0, =0.1.1, =1.0.47, =1.0.0, =1.2.0, =1.1.5, =0.0.1, =2.1.0, =0.1.11, =0.1.11, =0.1.20 - aisaratuners 1.4.2 and more Source cves: CVE-2022-35997 Source advisory: OSV:PYSEC-2026-3220...

axelerate (>=0.5.8, <=0.5.9), bianbu-ai-toolkit-tf1 (1.0.6) +27 more potentially affected by CVE-2022-35997 via tensorflow (1.15.3)

tensorflow PYPI version 1.15.3 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - axelerate =0.5.8, =0.0.1.2, =0.0.13, =1.1.0, =0.22.0, =1.6.0, =4.1.3, =0.10.0.dev1, =0.11.0 - muffnn 2.3.1 - neoepiscope 0.4.0 and more...

animalai-train (0.4.0), mlagents (>=0.4.0, <=0.10.0.dev0) +2 more potentially affected by CVE-2022-35997 via tensorflow (1.7.1)

tensorflow PYPI version 1.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - animalai-train 0.4.0 - mlagents =0.4.0, =0.10.0.dev0 - pytransdec 0.2.1 - unityagents 0.4.0 Source cves: CVE-2022-35997 Source advisory:...

accuinsight (1.0.1), aimodelshare (0.1.52) +83 more potentially affected by CVE-2022-35997 via tensorflow (1.13.1)

tensorflow PYPI version 1.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - accuinsight 1.0.1 - aimodelshare 0.1.52 - amber-automl =0.1.0, =19.3.0, =1.0.1, =1.1.0, =0.0.1, =0.3.4, =0.1.0, =0.0.1, =0.0.0.45.8, =1.1.1...

axelerate (>=0.5.2, <=0.5.5), bert-experimental (1.0.0) +24 more potentially affected by CVE-2022-35997 via tensorflow (1.15.2)

tensorflow PYPI version 1.15.2 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - axelerate =0.5.2, =2.0.1, =1.0.1, =0.1.0.dev1, =1.5.0.dev20210429, =1.5.0.dev20210512 - fedlearner-manylinux 1.5.0.dev20210429 -...

animalai-train (>=0.6.0, <=1.0.3), coach-cli (0.91.0) +3 more potentially affected by CVE-2022-35997 via tensorflow (1.12.2)

tensorflow PYPI version 1.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - animalai-train =0.6.0, =0.10.0, =0.3.2, =0.4.3 Source cves: CVE-2022-35997 Source advisory: OSV:PYSEC-2026-3220...

branchedgp (1.0.0), fate-client (>=0.1.0, <=1.5.3) +9 more potentially affected by CVE-2022-35997 via tensorflow (1.15.4)

tensorflow PYPI version 1.15.4 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - branchedgp 1.0.0 - fate-client =0.1.0, =0.2.2, =0.2.0, =0.2.4, =0.0.5.dev0, =1.5.0, =0.1.6, =0.2.4 Source cves: CVE-2022-35997 Source...

c4v-py (>=0.1.0.dev1, <=0.1.0.dev202107081840), lsmmdma (>=0.0.4, <=0.1.7) +6 more potentially affected by CVE-2022-35997 via tensorflow-cpu (>=2.1.0, <=2.7.0)

tensorflow-cpu PYPI version =2.1.0, =0.1.0.dev1, =0.0.4, =0.5.1, =0.102.0.dev0, =1.5.2, =1.7.4 - tpu-tf2 1.0.0 Source cves: CVE-2022-35997 Source advisory: OSV:PYSEC-2026-3356...