CVE-2021-29581: TensorFlow is an end-to-end open source platform for machine learning. Due to lack of validation in `tf.raw_ops.CTCBeamS
Summary
TensorFlow, a machine learning platform, has a vulnerability in one of its functions (`tf.raw_ops.CTCBeamSearchDecoder`) that fails to check if input data is empty before processing it. When an attacker provides empty input, the software crashes (segmentation fault, which is when a program tries to read from memory it shouldn't access), causing a denial of service (making the system unavailable).
Solution / Mitigation
The fix will be included in TensorFlow 2.5.0. The developers will also apply this fix to TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3, and TensorFlow 2.1.4, which are still supported versions.
Vulnerability Details
2.5(low)
EPSS: 0.0%
Classification
Taxonomy References
Affected Vendors
Related Issues
CVE-2022-29200: TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implem
CVE-2021-29541: TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a dereference of a null p
Original source: https://nvd.nist.gov/vuln/detail/CVE-2021-29581
First tracked: February 15, 2026 at 08:39 PM
Classified by LLM (prompt v3) · confidence: 95%