CVE-2021-29544: Denial of Service Vulnerability in TensorFlow
Summary
CVE-2021-29544: CHECK-fail in QuantizeAndDequantizeV4Grad. Affects tensorflow versions >= 2.4.0, < 2.4.2. Fixed in 2.4.2. How to fix ↓
Also tracked for
- tensorflow · Bitnami
- tensorflow-cpu · PyPI
- tensorflow-gpu · PyPI
The same CVE-2021-29544 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open-source machine learning framework developed by Google. It provides a comprehensive ecosystem of tools, libraries, and resources for building and deploying machine learning models. TensorFlow is widely used in various domains, including research, industry, and academia. However, a vulnerability has been discovered in TensorFlow that can lead to a denial of service (DoS) attack.
Vulnerability Detail
The vulnerability, identified as CVE-2021-29544, is a CHECK-fail in the QuantizeAndDequantizeV4Grad function of TensorFlow. An attacker can exploit this vulnerability by triggering a DoS attack through the use of specially crafted input. The issue arises due to the lack of validation of the rank of certain input tensors. As a result, these tensors are passed as they are to a subsequent function, which expects a specific rank and triggers a CHECK failure if the rank is incorrect. This vulnerability can be exploited to crash the TensorFlow application, leading to a DoS condition.
How To Fix
Latest published version: 2.21.0 as of 22 Oct 2026
pip install --upgrade "tensorflow==2.21.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.4.2
This is the first release that contains the fix.
pip install --upgrade "tensorflow==2.4.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the official patch or update TensorFlow to the fixed versions as soon as they are released.
Conclusion
The vulnerability in TensorFlow (CVE-2021-29544) can lead to a denial of service (DoS) attack. It is crucial for users of affected versions to update their installations to the patched versions once they are released. Applying the official patch or updating to the fixed versions will mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
This vulnerability can be exploited by an attacker to trigger a denial of service (DoS) attack, causing the TensorFlow application to crash and become unresponsive.
Yes, this vulnerability can be exploited remotely by an attacker who can send specially crafted input to the vulnerable TensorFlow application.
No, only TensorFlow versions 2.4.0 to 2.4.2 are affected by this vulnerability. Other versions are not impacted.
There is no evidence of this vulnerability being actively exploited in the wild at the time of this advisory. However, it is recommended to apply the patch or update as soon as possible to mitigate any potential risks.
For more information, please refer to the TensorFlow security guide at https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md. If you have further questions or concerns, you can contact the TensorFlow development team.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
