CVE-2021-29601: TensorFlow is an end-to-end open source platform for machine learning. The TFLite implementation of concatenation is vul
Summary
TensorFlow's TFLite (a lightweight version for mobile and embedded devices) has a bug where it can experience an integer overflow (when a number gets too large to fit in its assigned storage space) in the concatenation operation (combining multiple data arrays into one). An attacker could create a malicious machine learning model that exploits this by making dimension values too large, and this problem can occur when converting regular TensorFlow models to the TFLite format.
Solution / Mitigation
The fix will be included in TensorFlow 2.5.0. It will also be backported (applied to older versions still being supported) to TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3, and TensorFlow 2.1.4.
Vulnerability Details
6.3(medium)
EPSS: 0.0%
Classification
Taxonomy References
Affected Vendors
Related Issues
CVE-2022-21727: Tensorflow is an Open Source Machine Learning Framework. The implementation of shape inference for `Dequantize` is vulne
CVE-2026-22252: LibreChat is a ChatGPT clone with additional features. Prior to v0.8.2-rc2, LibreChat's MCP stdio transport accepts arbi
Original source: https://nvd.nist.gov/vuln/detail/CVE-2021-29601
First tracked: February 15, 2026 at 08:39 PM
Classified by LLM (prompt v3) · confidence: 92%