{"data":{"id":"af585da3-bf72-45b7-8651-83c97fdc1b5f","title":"CVE-2023-25661: TensorFlow is an Open Source Machine Learning Framework. In versions prior to 2.11.1 a malicious invalid input crashes…","summary":"CVE-2023-25661 affects TensorFlow versions prior to 2.11.1. A malicious invalid input to the `Convolution3DTranspose` function triggers a Check Failed crash in a model, enabling denial of service. Models containing this layer, deployed in ML applications or cloud services, are exposed, and an attacker must be able to supply input to a `Convolution3DTranspose` call.","solution":"Fixed in 2.11.1. Users are advised to upgrade to version 2.11.1. There are no known workarounds for this vulnerability.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2023-25661","publishedAt":"2023-03-28T00:15:09.417Z","cveId":"CVE-2023-25661","cweIds":["CWE-20"],"cvssScore":"6.5","cvssSeverity":"medium","severity":"medium","attackType":["denial_of_service"],"issueType":"vulnerability","affectedPackages":["tensorflow@< 2.11.1 (fixed: 2.11.1)","tensorflow-cpu@< 2.11.1 (fixed: 2.11.1)"],"affectedPackageNames":["tensorflow","tensorflow-cpu"],"affectedPackageRefs":["pypi:tensorflow","pypi:tensorflow-cpu"],"affectedVendors":[],"affectedVendorsRaw":["TensorFlow"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"TensorFlow denial of service via invalid input to Convolution3DTranspose","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00436,"epssCheckedAt":"2026-11-04T12:08:35.257Z","kevDateAdded":null,"advisoryAliases":["GHSA-fxgc-95xx-grvq"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:57:04.390Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2023-03-20T19:23:33.738Z","daysToFix":-8,"fixCheckedAt":"2026-10-29T21:47:06.654Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"tensorflow-cpu","fixedVersion":"2.11.1","matchedVersion":"2.11.1","fixReleasedAt":"2023-03-20T19:24:45.674Z","daysToFix":-8,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:47:06.502Z"},{"ecosystem":"pypi","name":"tensorflow","fixedVersion":"2.11.1","matchedVersion":"2.11.1","fixReleasedAt":"2023-03-20T19:23:33.738Z","daysToFix":-8,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:47:06.502Z"}]}}