alwakeupword (1.0.0), armadillin (>=0.0.2, <=0.53.0) +32 more potentially affected by CVE-2022-21736 via tensorflow (>=2.6.0, <=2.6.2)

tensorflow PYPI version =2.6.0, =0.0.2, =1.0.1, =0.2.0, =4.5.2, =1.1.2, =0.2.0, =0.0.1, =0.1.5, =1.0.3, =0.10.27, =0.11.10 and more Source cves: CVE-2022-21736 Source advisory: OSV:PYSEC-2026-3223...

PYSEC-2026-3173 Null pointer dereference in TensorFlow

Impact When building an XLA compilation cache, if default settings are used, TensorFlow triggers a null pointer dereference: cc string allowedgpus = flr-configproto-gpuoptions.visibledevicelist; In the default scenario, all devices are allowed, so flr-configproto is nullptr. Patches We have patch...

Undefined behavior in `SparseTensorSliceDataset`

Impact The implementation of SparseTensorSliceDataset has an undefined behavior: under certain condition it can be made to dereference a nullptr value:pythonimport tensorflow as tfimport numpy as nptf.rawops.SparseTensorSliceDataset indices=, values=, denseshape=1,1The 3 input arguments represent...

alwakeupword (1.0.0), armadillin (>=0.0.2, <=0.53.0) +32 more potentially affected by CVE-2022-21739 via tensorflow (>=2.6.0, <=2.6.2)

tensorflow PYPI version =2.6.0, =0.0.2, =1.0.1, =0.2.0, =4.5.2, =1.1.2, =0.2.0, =0.0.1, =0.1.5, =1.0.3, =0.10.27, =0.11.10 and more Source cves: CVE-2022-21739 Source advisory: OSV:PYSEC-2026-3094...

accuinsight (1.0.1), aimodelshare (0.1.52) +84 more potentially affected by CVE-2022-23570 via tensorflow (1.13.1)

tensorflow PYPI version 1.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - accuinsight 1.0.1 - aimodelshare 0.1.52 - amber-automl =0.1.0, =19.3.0, =1.0.1, =1.1.0, =0.0.1, =0.3.4, =0.1.0, =0.0.1, =0.0.0.45.8, =1.1.1...

accuinsight (1.0.1), aimodelshare (0.1.52) +84 more potentially affected by CVE-2022-21736 via tensorflow (1.13.1)

tensorflow PYPI version 1.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - accuinsight 1.0.1 - aimodelshare 0.1.52 - amber-automl =0.1.0, =19.3.0, =1.0.1, =1.1.0, =0.0.1, =0.3.4, =0.1.0, =0.0.1, =0.0.0.45.8, =1.1.1...

abmarl (>=0.1.1, <=0.1.3), accuinsight (>=1.0.47, <=3.0.0) +472 more potentially affected by CVE-2022-21739 via tensorflow (>=2.0.0, <=2.5.2)

tensorflow PYPI version =2.0.0, =0.1.1, =1.0.47, =1.0.0, =1.2.0, =1.1.5, =0.0.1, =2.1.0, =0.5.6, =0.5.0, =0.1.0, =0.1.8 and more Source cves: CVE-2022-21739 Source advisory: OSV:PYSEC-2026-3094...

PYSEC-2026-3258 Integer overflow leading to crash in Tensorflow

Impact The implementation of SparseCountSparseOutput can be made to crash a TensorFlow process by an integer overflow whose result is then used in a memory allocation: python import tensorflow as tf import numpy as np tf.rawops.SparseCountSparseOutput indices=1,1, values=2, denseshape=2 31, 2 32,...

Assertion failure based denial of service in Tensorflow

Impact The implementation of Bincount operations allows malicious users to cause denial of service by passing in arguments which would trigger a CHECK-fail:pythonimport tensorflow as tftf.rawops.DenseBincount input=0, 1, 2, size=1, weights=3,2,1, binaryoutput=FalseThere are several conditions tha...

Null-dereference in Tensorflow

ImpactWhen decoding a tensor from protobuf, TensorFlow might do a null-dereference if attributes of some mutable arguments to some operations are missing from the proto. This is guarded by a DCHECK:cc const auto attr = attrs.Findarg-s; DCHECKattr != nullptr; if attr-valuecase == AttrValue::kList ...

Null pointer dereference in TensorFlow

ImpactWhen building an XLA compilation cache, if default settings are used, TensorFlow triggers a null pointer dereference:cc string allowedgpus = flr-configproto-gpuoptions.visibledevicelist; In the default scenario, all devices are allowed, so flr-configproto is nullptr. PatchesWe have patched...

PYSEC-2026-3164 Assertion failure based denial of service in Tensorflow

Impact The implementation of Bincount operations allows malicious users to cause denial of service by passing in arguments which would trigger a CHECK-fail: python import tensorflow as tf tf.rawops.DenseBincount input=0, 1, 2, size=1, weights=3,2,1, binaryoutput=False There are several conditions...

PYSEC-2026-3153 Null-dereference in Tensorflow

Impact When decoding a tensor from protobuf, TensorFlow might do a null-dereference if attributes of some mutable arguments to some operations are missing from the proto. This is guarded by a DCHECK: cc const auto attr = attrs.Findarg-s; DCHECKattr != nullptr; if attr-valuecase == AttrValue::kLis...

axelerate (>=0.5.2, <=0.5.5), bert-experimental (1.0.0) +24 more potentially affected by CVE-2022-21737 via tensorflow (1.15.2)

tensorflow PYPI version 1.15.2 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - axelerate =0.5.2, =2.0.1, =1.0.1, =0.1.0.dev1, =1.5.0.dev20210429, =1.5.0.dev20210512 - fedlearner-manylinux 1.5.0.dev20210429 -...

azureml-automl-core (>=1.0.23, <=1.0.33), kassandra (0.0.1) +3 more potentially affected by CVE-2022-21739 via tensorflow (1.11.0)

tensorflow PYPI version 1.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - azureml-automl-core =1.0.23, =2.0.2, =0.3.4, =0.6.2, =0.6.5 Source cves: CVE-2022-21739 Source advisory: OSV:PYSEC-2026-3094...

es-distributed (0.1.0.dev0), strawberryfields (>=0.7.0, <=0.7.1) +1 more potentially affected by CVE-2022-23570 via tensorflow (1.3.0)

tensorflow PYPI version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - es-distributed 0.1.0.dev0 - strawberryfields =0.7.0, =0.7.1 - utensor-cgen 0.0.4 Source cves: CVE-2022-23570 Source advisory:...

animalai-train (0.4.0), mlagents (>=0.4.0, <=0.10.0.dev0) +2 more potentially affected by CVE-2022-21736 via tensorflow (1.7.1)

tensorflow PYPI version 1.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - animalai-train 0.4.0 - mlagents =0.4.0, =0.10.0.dev0 - pytransdec 0.2.1 - unityagents 0.4.0 Source cves: CVE-2022-21736 Source advisory:...

es-distributed (0.1.0.dev0), strawberryfields (>=0.7.0, <=0.7.1) +1 more potentially affected by CVE-2022-21738 via tensorflow (1.3.0)

tensorflow PYPI version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - es-distributed 0.1.0.dev0 - strawberryfields =0.7.0, =0.7.1 - utensor-cgen 0.0.4 Source cves: CVE-2022-21738 Source advisory:...

animalai-train (>=0.6.0, <=1.0.3), coach-cli (0.91.0) +3 more potentially affected by CVE-2022-21738 via tensorflow (1.12.2)

tensorflow PYPI version 1.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - animalai-train =0.6.0, =0.10.0, =0.3.2, =0.4.3 Source cves: CVE-2022-21738 Source advisory: OSV:PYSEC-2026-3258...

fancy-nlp (>=0.0.1, <=0.0.4), nyoka (>=1.0.0, <=1.5.4) +3 more potentially affected by CVE-2022-21739 via tensorflow (1.9.0)

tensorflow PYPI version 1.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - fancy-nlp =0.0.1, =1.0.0, =0.11.0, =0.5.4, =0.5.7 Source cves: CVE-2022-21739 Source advisory: OSV:PYSEC-2026-3094...