{"data":{"id":"4505dbc9-ad26-48f6-9aaf-5b1d87c58e07","title":"CVE-2020-26269: In TensorFlow release candidate versions 2.4.0rc*, the general implementation for matching filesystem paths to globbing…","summary":"CVE-2020-26269 affects TensorFlow release candidate versions 2.4.0rc*, where the general implementation that matches filesystem paths to a globbing pattern can access the array holding the directories out of bounds. The parallel implementation of GetMatchingPaths assumes invariants and preconditions that the PRs #40861 and #44310 never verified. The issue impacts only the master branch and the 2.4 release candidates.","solution":"This is patched in version 2.4.0. The final release of the 2.4 release will be patched.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2020-26269","publishedAt":"2020-12-11T04:15:12.910Z","cveId":"CVE-2020-26269","cweIds":["CWE-125","CWE-125"],"cvssScore":"7.5","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["tensorflow@>= 2.4.0rc0, < 2.4.0 (fixed: 2.4.0)","tensorflow-cpu@>= 2.4.0rc0, < 2.4.0 (fixed: 2.4.0)","tensorflow-gpu@>= 2.4.0rc0, < 2.4.0 (fixed: 2.4.0)"],"affectedPackageNames":["tensorflow","tensorflow-cpu","tensorflow-gpu"],"affectedPackageRefs":["pypi:tensorflow","pypi:tensorflow-cpu","pypi:tensorflow-gpu"],"affectedVendors":["Google"],"affectedVendorsRaw":["TensorFlow"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"TensorFlow out of bounds access in filesystem glob path matching","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00697,"epssCheckedAt":"2026-11-04T06:10:14.410Z","kevDateAdded":null,"advisoryAliases":["GHSA-9jjw-hf72-3mxw"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T04:00:48.648Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2020-12-14T17:58:05.761Z","daysToFix":3,"fixCheckedAt":"2026-10-29T21:52:27.430Z","capecIds":["CAPEC-540"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"tensorflow-cpu","fixedVersion":"2.4.0","matchedVersion":"2.4.0","fixReleasedAt":"2020-12-14T18:03:16.312Z","daysToFix":3,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:52:27.274Z"},{"ecosystem":"pypi","name":"tensorflow-gpu","fixedVersion":"2.4.0","matchedVersion":"2.4.0","fixReleasedAt":"2020-12-14T18:06:16.807Z","daysToFix":3,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:52:27.274Z"},{"ecosystem":"pypi","name":"tensorflow","fixedVersion":"2.4.0","matchedVersion":"2.4.0","fixReleasedAt":"2020-12-14T17:58:05.761Z","daysToFix":3,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:52:27.274Z"}]}}