CVE-2022-21725: Tensorflow division by zero in cost estimation for convolution operations

Summary

TensorFlow's cost estimator for some convolution operations can be made to execute a division by 0. The function fails to check that the stride argument is strictly positive.

Mitigation

The fix adds a check on the stride argument to ensure it is valid. It will be included in TensorFlow 2.8.0, and the same commit will be cherry-picked to TensorFlow 2.7.1, 2.6.3 and 2.5.3, which are also affected and still in supported range.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• tensorflowPyPINo LLM dependency detected · 26 tracked dependents
• tensorflow-gpuPyPINo LLM dependency detected · 2 tracked dependents

Related items

• LowCloakFEM: Agentic FEM Code Generation for Red-Teaming Computational Resource ExhaustionSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• MediumThe Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model ResourcesSimilar attack · Google Threat Intelligence
• InfoThe Blind Spots of Detection: Adversarial Perturbation Attacks against Watchdogs in Distributed LLM InferenceSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• HighCVE-2026-118761: Kubeflow Pipelines decompression bomb in pipeline archive uploadSimilar attack · NVD/CVE Database
• LowOpenCode User Hit with Hostile Backlash After Reporting Free AI LoopholeSimilar attack · Socket Blog