CVE-2022-36004: TensorFlow is an open source platform for machine learning. When `tf.random.gamma` receives large input shape and rates,
Summary
TensorFlow (an open source machine learning platform) has a bug in its `tf.random.gamma` function where large input values can cause a denial of service attack (making the system crash or stop responding). The developers have fixed the issue and will release it in TensorFlow 2.10.0, along with updates to older supported versions.
Solution / Mitigation
Update to TensorFlow 2.10.0, or if you need an earlier version, update to TensorFlow 2.9.1, TensorFlow 2.8.1, or TensorFlow 2.7.2, as these versions include the patch from GitHub commit 552bfced6ce4809db5f3ca305f60ff80dd40c5a3. The source notes there are no known workarounds for this issue.
Vulnerability Details
5.9(medium)
EPSS: 0.1%
Classification
Taxonomy References
Affected Vendors
Related Issues
CVE-2022-29200: TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implem
CVE-2021-29541: TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a dereference of a null p
Original source: https://nvd.nist.gov/vuln/detail/CVE-2022-36004
First tracked: February 15, 2026 at 08:41 PM
Classified by LLM (prompt v3) · confidence: 95%