CVE-2020-15206: TensorFlow SavedModel loading segfault and data corruption from altered keys

Summary

CVE-2020-15206 affects TensorFlow versions before 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1. Altering the SavedModel protocol buffer and renaming required keys causes segfaults and data corruption while the model loads, which can cause a denial of service in products using tensorflow-serving or other inference-as-a-service installments.

Mitigation

The issue is patched in commit adf095206f25471e864a8e63a0f1caef53a0e3a6 and released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• tensorflowPyPINo LLM dependency detected · 26 tracked dependents
• tensorflow-gpuPyPINo LLM dependency detected · 2 tracked dependents

Related items

• LowCloakFEM: Agentic FEM Code Generation for Red-Teaming Computational Resource ExhaustionSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• MediumThe Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model ResourcesSimilar attack · Google Threat Intelligence
• InfoThe Blind Spots of Detection: Adversarial Perturbation Attacks against Watchdogs in Distributed LLM InferenceSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• HighCVE-2026-118761: Kubeflow Pipelines decompression bomb in pipeline archive uploadSimilar attack · NVD/CVE Database
• LowOpenCode User Hit with Hostile Backlash After Reporting Free AI LoopholeSimilar attack · Socket Blog