MediumVulnerability
CVE-2020-15192: TensorFlow memory leak in dlpack.to_dlpack on validation failure
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2020-15192
- Published
- Record updated
- Affected
- tensorflow = 2.2.0, fixed in 2.2.1
- tensorflow = 2.3.0, fixed in 2.3.1
- tensorflow-cpu = 2.2.0, fixed in 2.2.1
- and 3 more
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.8%
Summary
Tensorflow versions before 2.2.1 and 2.3.1 leak memory when a user passes a list of strings to `dlpack.to_dlpack`. The leak follows an expected validation failure because the `status` argument is not checked after the methods that can return an error status.
Mitigation
The issue is patched in commit 22e07fb204386768e5bcbea563641ea11f96ceb8 and is released in TensorFlow versions 2.2.1 or 2.3.1.
Related items
- CriticalCVE-2026-90970: GitLab AI Gateway prompt template sandbox escape via crafted flow configurationSame vendor · NVD/CVE Database
- MediumCVE-2026-89278: GPTranslate WordPress plugin exposes plaintext API key to unauthenticated usersSame vendor · NVD/CVE Database
- CriticalCVE-2026-19407: Google Cloud Gemini Enterprise Agent Platform SDK for Python bucket squattingSame vendor · NVD/CVE Database
- HighCVE-2026-19486: A Server-Side Request Forgery (SSRF) vulnerability in Google Cloud Gemini Enterprise Agent Platform App Builder…Same vendor · NVD/CVE Database
- HighCVE-2026-13745: Gemini CLI code execution via untrusted .env files overriding GEMINI_CLI_HOMESame vendor · NVD/CVE Database