{"data":{"id":"db6dfbd9-de92-4b53-99b8-27d60652e477","title":"CVE-2021-29580: TensorFlow is an end-to-end open source platform for machine learning. The implementation of…","summary":"The implementation of tf.raw_ops.FractionalMaxPoolGrad in TensorFlow triggers undefined behavior when one of its input tensors is empty. The code also fails to validate that input and output tensors are not empty and are of the same rank, and a CHECK condition that becomes false aborts the process, enabling a denial of service attack.","solution":"Fix will be included in TensorFlow 2.5.0. The commit will also be cherrypicked to TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2021-29580","publishedAt":"2021-05-15T00:15:14.293Z","cveId":"CVE-2021-29580","cweIds":["CWE-908"],"cvssScore":"2.5","cvssSeverity":"low","severity":"low","attackType":["denial_of_service"],"issueType":"vulnerability","affectedPackages":["tensorflow@< 2.1.4 (fixed: 2.1.4)","tensorflow@>= 2.2.0, < 2.2.3 (fixed: 2.2.3)","tensorflow@>= 2.3.0, < 2.3.3 (fixed: 2.3.3)","tensorflow@>= 2.4.0, < 2.4.2 (fixed: 2.4.2)","tensorflow-cpu@< 2.1.4 (fixed: 2.1.4)","tensorflow-cpu@>= 2.2.0, < 2.2.3 (fixed: 2.2.3)","tensorflow-cpu@>= 2.3.0, < 2.3.3 (fixed: 2.3.3)","tensorflow-cpu@>= 2.4.0, < 2.4.2 (fixed: 2.4.2)","tensorflow-gpu@< 2.1.4 (fixed: 2.1.4)","tensorflow-gpu@>= 2.2.0, < 2.2.3 (fixed: 2.2.3)","tensorflow-gpu@>= 2.3.0, < 2.3.3 (fixed: 2.3.3)","tensorflow-gpu@>= 2.4.0, < 2.4.2 (fixed: 2.4.2)"],"affectedPackageNames":["tensorflow","tensorflow-cpu","tensorflow-gpu"],"affectedPackageRefs":["pypi:tensorflow","pypi:tensorflow-cpu","pypi:tensorflow-gpu"],"affectedVendors":["Google"],"affectedVendorsRaw":["TensorFlow"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"TensorFlow denial of service and undefined behavior in FractionalMaxPoolGrad","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00189,"epssCheckedAt":"2026-11-04T18:09:14.050Z","kevDateAdded":null,"advisoryAliases":["GHSA-x8h6-xgqx-jqgp"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T04:00:11.198Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2021-06-15T21:01:30.053Z","daysToFix":31,"fixCheckedAt":"2026-10-29T21:51:31.651Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"tensorflow","fixedVersion":"2.3.3","matchedVersion":"2.3.3","fixReleasedAt":"2021-06-15T21:03:30.442Z","daysToFix":31,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:51:31.497Z"},{"ecosystem":"pypi","name":"tensorflow","fixedVersion":"2.4.2","matchedVersion":"2.4.2","fixReleasedAt":"2021-06-15T21:03:59.541Z","daysToFix":31,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:51:31.497Z"},{"ecosystem":"pypi","name":"tensorflow-gpu","fixedVersion":"2.4.2","matchedVersion":"2.4.2","fixReleasedAt":"2021-06-15T21:09:49.706Z","daysToFix":31,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:51:31.497Z"},{"ecosystem":"pypi","name":"tensorflow-cpu","fixedVersion":"2.3.3","matchedVersion":"2.3.3","fixReleasedAt":"2021-06-15T21:04:54.421Z","daysToFix":31,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:51:31.497Z"},{"ecosystem":"pypi","name":"tensorflow-cpu","fixedVersion":"2.2.3","matchedVersion":"2.2.3","fixReleasedAt":"2021-06-15T21:05:45.961Z","daysToFix":31,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:51:31.497Z"},{"ecosystem":"pypi","name":"tensorflow-cpu","fixedVersion":"2.1.4","matchedVersion":"2.1.4","fixReleasedAt":"2021-06-15T21:01:55.318Z","daysToFix":31,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:51:31.497Z"},{"ecosystem":"pypi","name":"tensorflow-gpu","fixedVersion":"2.1.4","matchedVersion":"2.1.4","fixReleasedAt":"2021-06-15T21:03:57.218Z","daysToFix":31,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:51:31.497Z"},{"ecosystem":"pypi","name":"tensorflow-gpu","fixedVersion":"2.2.3","matchedVersion":"2.2.3","fixReleasedAt":"2021-06-15T21:11:39.648Z","daysToFix":31,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:51:31.497Z"},{"ecosystem":"pypi","name":"tensorflow-gpu","fixedVersion":"2.3.3","matchedVersion":"2.3.3","fixReleasedAt":"2021-06-15T21:08:37.651Z","daysToFix":31,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:51:31.497Z"},{"ecosystem":"pypi","name":"tensorflow-cpu","fixedVersion":"2.4.2","matchedVersion":"2.4.2","fixReleasedAt":"2021-06-15T21:05:30.770Z","daysToFix":31,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:51:31.497Z"},{"ecosystem":"pypi","name":"tensorflow","fixedVersion":"2.1.4","matchedVersion":"2.1.4","fixReleasedAt":"2021-06-15T21:01:30.053Z","daysToFix":31,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:51:31.497Z"},{"ecosystem":"pypi","name":"tensorflow","fixedVersion":"2.2.3","matchedVersion":"2.2.3","fixReleasedAt":"2021-06-15T21:03:54.731Z","daysToFix":31,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:51:31.497Z"}]}}