CVE-2022-36001: TensorFlow is an open source platform for machine learning. When `DrawBoundingBoxes` receives an input `boxes` that is n
Summary
TensorFlow (an open-source machine learning platform) has a vulnerability in its `DrawBoundingBoxes` function where receiving input boxes that aren't float data types causes a CHECK fail, which can be exploited to disable the system through a denial of service attack (overwhelming it with requests). The vulnerability affects multiple versions of TensorFlow.
Solution / Mitigation
The issue has been patched in GitHub commit da0d65cdc1270038e72157ba35bf74b85d9bda11. Users should update to TensorFlow 2.10.0, or for earlier versions, update to TensorFlow 2.9.1, 2.8.1, or 2.7.2, as these patched versions are available for affected and still-supported releases. No workarounds exist.
Vulnerability Details
5.9(medium)
EPSS: 0.1%
Classification
Taxonomy References
Affected Vendors
Related Issues
CVE-2022-29200: TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implem
CVE-2021-29541: TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a dereference of a null p
Original source: https://nvd.nist.gov/vuln/detail/CVE-2022-36001
First tracked: February 15, 2026 at 08:41 PM
Classified by LLM (prompt v3) · confidence: 95%