CVE-2021-41200: Incomplete validation in tf.summary.create_file_writer
Summary
CVE-2021-41200: Incomplete validation in tf.summary.create_file_writer. Affects tensorflow across 3 version ranges.
< 2.4.4
>= 2.5.0, < 2.5.2
>= 2.6.0, < 2.6.1
Fixed in 2.4.4, 2.5.2 or 2.6.1, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow · Bitnami
- tensorflow-cpu · PyPI
- tensorflow-gpu · PyPI
The same CVE-2021-41200 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The TensorFlow package is an open-source machine learning framework developed by Google. It provides a comprehensive set of tools and libraries for building and deploying machine learning models. The tf.summary.create_file_writer function is part of the TensorFlow Summary API and is used to create a file writer for writing summary data to disk. Summary data is often used for visualizing and monitoring the progress of machine learning models during training. However, a vulnerability has been discovered in the tf.summary.create_file_writer function that can lead to a crash if called with non-scalar arguments.
Vulnerability Detail
The vulnerability (CVE-2021-41200) in tf.summary.create_file_writer arises from incomplete validation of input arguments. When the function is called with non-scalar arguments, a CHECK-fail occurs, resulting in a crash. An example of triggering this vulnerability is by passing a non-scalar array to the flush_millis parameter. This vulnerability can potentially disrupt the execution of TensorFlow code and impact the stability of machine learning models. The severity of this vulnerability is rated as MODERATE with a CVSS score of 5.5.
How To Fix
Latest published version: 2.21.0 as of 22 Oct 2026
pip install --upgrade "tensorflow==2.21.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.4.42.4.4pip install --upgrade "tensorflow==2.4.4" -
>= 2.5.0, < 2.5.22.5.2pip install --upgrade "tensorflow==2.5.2" -
>= 2.6.0, < 2.6.12.6.1pip install --upgrade "tensorflow==2.6.1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, the vulnerability (CVE-2021-41200) in tf.summary.create_file_writer can lead to crashes in TensorFlow code when called with non-scalar arguments. It is recommended to update to the patched versions of TensorFlow (2.7.0, 2.6.1, 2.5.2, or 2.4.4) to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
The impact of this vulnerability is that if tf.summary.create_file_writer is called with non-scalar arguments, it can cause a crash in the code.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your TensorFlow installation is affected by this vulnerability. Simply upload your Pipfile.lock and the playground will provide real-time alerts for open-source vulnerabilities.
Yes, the CVSS score for this vulnerability is 5.5, indicating a moderate severity level.
There are no known exploits for this vulnerability at the time of this report.
You can refer to the TensorFlow security guide (https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information about the security model and how to report issues or ask questions.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
